Research
Security News
Quasar RAT Disguised as an npm Package for Detecting Vulnerabilities in Ethereum Smart Contracts
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
Basic data flow analyses framework based on esprima
$ npm install analyses
analyses depends on a globally available Map
, which can either be provided by
running with --harmony
or by preloading a shim before using the library.
analyses itself explicitly does not depend on a shim itself, to be more forward
compatible and to give you more choice.
Since the collections, specifically Set
in --harmony
do not support any method to iterate over them,
analyses provides a minimal analyses.Set
shim with some useful set operations.
This will change once native --harmony
Sets are actually useful.
var cfg = esgraph(esprima.parse('…'));
var output = analyses(cfg, function (input, list) {
this; // the cfg node
input; // the input set
list; // the worklist `.push()` nodes to it.
return new analyses.Set(); // either return a new output Set
// or return an output Set and `enqueue: false` so the worklist algorithm does
// not check and enqueue successors itself.
return {output: new analyses.Set(), enqueue: false}
}, {
// direction:
// forward or backward; defaults to forward
direction: 'forward',
// custom merge function:
// typically union or intersect; defaults to union
// merge function takes an array of inputs
// `analyses.merge()` wraps a function which takes a pair `a, b` of inputs
merge: analyses.merge(analyses.Set.union),
// custom equals function:
// this is used to determine if the output of a node still changes and to
// not enqueue any more successors and stop the iteration; defaults to
// Set.equals
equals: analyses.Set.equals
});
// the output is a `Map` from CFG nodes to a result set of type `analyses.Set`
output.get(cfg[0]).values()
LGPLv3
FAQs
basic data flow analyses framework based on esprima
We found that analyses demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
Security News
Research
A supply chain attack on Rspack's npm packages injected cryptomining malware, potentially impacting thousands of developers.
Research
Security News
Socket researchers discovered a malware campaign on npm delivering the Skuld infostealer via typosquatted packages, exposing sensitive data.