
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
code-pluck
Advanced tools
A command line utility to perform SQL-like queries on JavaScript codebases.
pluck allows you to search for pieces of code in your project by syntactic type, treating your code like an AST database.
To install
> yarn global add code-pluck
Then, to see all the arrow functions you've written in the project at your current working directory:
> pluck 'select * from $downstream.arrowfunctionexpressions'
To see them and then cut them all with one command:
> pluck 'select * from $downstream.arrowfunctionexpressions' --post cut
To comment out all of the console.whatever() calls in your project:
pluck 'select * from $downstream.memberexpressions where "callee.object.name" like "console%"' --post commentOutLine
Note the " " around the property lookup in the where expression.
To comment out all of the console.whatever() calls in your project only in files where the path matches test:
pluck 'select * from "/test/.memberexpressions" where "callee.object.name" like "console%"' --post commentOutLine
Note, also, the " " around the target in the from expression.
The general form of the api looks like this:
> pluck 'select [propertyName | *] from ["$downstream" | /pattern/].[ast-type-name] where [propertyName[.member, ...]]] like "some value"' --post [post-function-name]
ast-type-name can be any valid babel type, lowercased: see here, or a valid pluck-defined alias.
Types are either plural or singular: plural type names with return all matches for a type per file, singular with stop at the first match.
Pluralisation is simplified to adding "s" to the end of the type, regardless of whether doing so is correct in terms of English grammar.
> pluck 'select * from $downstream.identifier' # -> maximum of one result per file
> pluck 'select * from $downstream.identifiers' # -> many results per file
There are a number of aliases (WIP) for type names, currently these can be learned by inspecting src/ast-aliases.js.
For example:
> pluck 'select * from $downstream.fatarrows'
> # same as
> pluck 'select * from $downstream.arrowfunctionexpressions'
The * (asterix) token when used with select will return the entire piece of code that is matched as a string.
> pluck 'select * from $downstream.fatarrows'
// ... more results above
---
11: (line 36)
async (someArg) => {
return await fetch(...someArgs)
}
// ... more results below
Alternatively, select can be used with a property name:
> pluck 'select params from $downstream.fatarrows'
// ... more results above
########
path: /my-project/myfile.js
[
Node {
type: 'Identifier',
start: 132,
end: 141,
loc: SourceLocation {
start: [Position],
end: [Position],
filename: undefined,
identifierName: 'props'
},
name: 'someArg'
}
]
// ... more results below
The where expression can look up nested object properties. So were I to refine the last query to have a good chance of only returning the highlighted result, I could try:
> pluck 'select params from $downstream.fatarrows where "params.0.name" like "someArg"'
Code Pluck accepts a --post flag which allows a user to apply a function to the query results.
Currently the two supported functions are:
cut
pluck 'select * from $downstream.stringliterals where value like "a%"' --post cut
Will cut all string literal expressions which start with "a".
commentOutLine
pluck 'select * from $downstream.identifiers where value like "console%"' --post commentOutLine
Will comment out any lines that contain the variable name "console".
FAQs
A command line utility to perform SQL-like queries on JavaScript codebases.
We found that code-pluck demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.