
Research
Two Malicious Rust Crates Impersonate Popular Logger to Steal Wallet Keys
Socket uncovers malicious Rust crates impersonating fast_log to steal Solana and Ethereum wallet keys from source code.
It's a parser! It's a linter! It's a formatter! It's an IDE! It's BABLR!
BABLR helps people write code by letting them easily use Javascript code to create and modify code written in any language. In particular, it enables more accurate analysis of code than has previously been possible in order to support the creation of new fully-semantic (visual, tactile) code editors.
An HTML-like streaming serialization format called CSTML supports efficient streaming of BABLR parse trees across language or device barriers.
Rather than a formal schema definition, a language is defined through the provision of useful APIs for working with valid documents written in that language.
This API differs from that of most other production-grade parsers, which are most often parser generators. BABLR grammars are purely runtime Javascript, and so tend to be extremely lightweight compared to comparable compiled forms. All parsing and traversal is done in a streaming manner to the extent possible.
BABLR is unready for production usage, and will continue to be so until v1.0.0
is released. For right now the more people try out this code and provide me feedback, the faster I will make progress towards production-readiness!
import { parseCSTML } from 'bablr';
import { i } from '@bablr/boot';
const digits = class {
constructor() {
this.covers = {
[Symbol.for('@bablr/node')]: ['Number', 'Digit'],
};
}
*Number() {
while (yield i`eat(<| Digit .digits |>)`);
}
*Digit() {
yield i`eat(/\d/)`;
}
};
parseCSTML(digits, '42');
// <Number>
// digits:
// <Digit>
// '4'
// </>
// digits:
// <Digit>
// '2'
// </>
// </>
BABLR is actually portmanteau of Babel and ANTLR. It would be reasonable to describe this project as being a mixture of the ideas from those two, with a bit of help from SrcML, Tree-sitter, and the fabulous Redux.
It is also designed with the needs of Prettier and ESLint in mind.
FAQs
The primary BABLR APIs
The npm package bablr receives a total of 18 weekly downloads. As such, bablr popularity was classified as not popular.
We found that bablr demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Socket uncovers malicious Rust crates impersonating fast_log to steal Solana and Ethereum wallet keys from source code.
Research
A malicious package uses a QR code as steganography in an innovative technique.
Research
/Security News
Socket identified 80 fake candidates targeting engineering roles, including suspected North Korean operators, exposing the new reality of hiring as a security function.