Security News
38% of CISOs Fear They’re Not Moving Fast Enough on AI
CISOs are racing to adopt AI for cybersecurity, but hurdles in budgets and governance may leave some falling behind in the fight against cyber threats.
AST tooling framework for JavaScript focused on modularity and performance. The goal is to make it easy to create, share, and combine tools that operate on ASTs. The architecture inspired by llvm.
Various passes are registered in Astral. Esprima (parser) creates AST. Astral runs the passes in order based on their prerequisites.
npm install astral
var esprima = require('esprima');
var escodegen = require('escodegen');
var astral = require('astral')();
var myPass = require('astral-pass')();
myPass.name = 'myPass';
myPass.
when({
// ... AST chunk
}).
when(function (chunk, info) {
// return true or false
}).
transform(function (chunk, info) {
});
astral.register(myPass);
var ast = esprima.parse('var x = 42;');
var newAst = astral.run(ast);
var newSrc = escodegen.generate(newAst);
console.log(newSrc);
A pass is just an object with three properties:
var myPass = {
name: 'my:pass',
prereqs: [],
run: function (ast, info) {
return {};
}
}
The name of the pass. Used to reference prereqs and info.
An array of passes expected to be run before this pass is run.
The function for transforming the AST. It takes two arguments: ast
, and info
. It should return an info
object to be associated with this pass.
Source transform tools all have to solve the same problems:
Using multiple code transform tools results in a lot of expensive, repeated work. Items 1-2 and 5-6 above are usually exactly the same across tools, and 3-4 are often implemented with similar, generic algorithms using different parameters or slightly different behaviors.
Astral is a framework that lets you plug in a set of "passes" that do steps 3-4, while generically sharing the rest of the process.
How does Astral compare to these projects?
Falafel is a lib for doing source transforms. You could use it inside of an Astral pass.
Rocambole is like Falafel: a tool for making the changes. Again, it'd be great to make use of this library inside of a pass.
Browserify is a tool that does source code transforms as a module/build solution. Browserify has the option to include your own transforms that get run before Browserify transforms CommonJS-style modules into a format that's more suitable for web browsers. The downside of this system is that you can't easily use these transforms if you're not using Browserify. Ideally, Browserify could be built on top of Astral.
ngmin does transforms on AngularJS apps to make the source easier to minify. Ideally, ngmin could also be built on top of Astral. The advantage to this is that it would be easier and faster to combine a build process using both ngmin and Browserify. Currently, both of these tools separately read files, parse into an AST, generate code form the AST, and save back to a file.
Grunt is a task runner. It is often used as a build tool, concatenating and minifying files. Grunt typically runs on a per-file basis, which makes it great for a wide variety of cases, but a poor choice for source transforms since you typically end up reading/writing the same file multiple times. You can think of Astral as "Grunt tasks, but for ASTs instead of files." You could write a Grunt task to run Astral passes to integrate the two.
MIT
FAQs
AST tooling framework for JavaScript
The npm package astral receives a total of 2,969 weekly downloads. As such, astral popularity was classified as popular.
We found that astral demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
CISOs are racing to adopt AI for cybersecurity, but hurdles in budgets and governance may leave some falling behind in the fight against cyber threats.
Research
Security News
Socket researchers uncovered a backdoored typosquat of BoltDB in the Go ecosystem, exploiting Go Module Proxy caching to persist undetected for years.
Security News
Company News
Socket is joining TC54 to help develop standards for software supply chain security, contributing to the evolution of SBOMs, CycloneDX, and Package URL specifications.