
Research
2025 Report: Destructive Malware in Open Source Packages
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.
comment-patterns
Advanced tools
A list of comment-patterns for different languages
This module contains an extract of the language-database of groc
with information about how single- and multi-line comments are written in different languages.
var commentPattern = require('comment-patterns');
var p = commentPattern('filename.js');
This will lead to p being:
{
name: "JavaScript",
nameMatchers: [".js"],
multiLineComment: [{
start: /\/\*\*/,
middle: "*",
end: "*/",
apidoc: true
}, {
start: /\/\*/,
middle: "*",
end: "*/"
}],
singleLineComment: [{
start: "//"
}]
}
It is also possible to retrieve a regular expression that matches comments (up to the next line of code):
var re = commentPattern.regex('filename.js');
The result re will be:
{
regex: /^([ \t]*)(\/\*\*([\s\S]*?)\*\/|\/\*([\s\S]*?)\*\/|((?:[ \t]*?\/\/.*\r?\n?)+))[\r\n]*/gm,
cg: {
indent: 1,
wholeComment: 2,
contentStart: 3
},
middle: [/^[ \t]*\*/gm, /^[ \t]*\*/gm, /^[ \t]*\/\//gm],
name: "JavaScript",
info: [{
type: "multiline",
apidoc: true
}, {
type: "multiline"
}, {
type: "singleline"
}]
}
match[cg.indent] contains the spaces that indent comment-start-delimiter.match[cg.wholeComment] matches the comment including delimiters.match[cg.contentStart] is the first group that captures the contents of the comment
In this case, there are multiple possible delimiters, so dependending on which
delimiter is used, match[cg.contentStart] or match[cg.contentStart + 1] is
filled. the others are undefined. cg.contentStart that matches
the prefix used before comment lines. It can be used to remove this prefix.
If the middle-prefix for this capturing group is empty (''), the pattern is null. cg.contentStart, currently
this information is only { apidocs: true } if the group is matching an apidoc comment.For API-documentation, it is important to determine the context of the comment (i.e. the thing that the comment is documenting). Although this does not strictly belong to the comment itself, this library also has methods to determine the code-context of a comment These are functions that return a json by matching a single-line of code against a regular expression.
var detector = commentPattern.codeContext("filename.js");
var cc = detector("function abc(param1,param2) {",2);
The result in cc will be
{
begin: 2,
type: "function statement",
name: "abc",
params: ["param1", "param2"],
string: "abc()",
original: "function abc(param1,param2) {"
}
This result (for 'JavaScript' is actuall taken from the parse-code-context module by Jon Schlinkert.
The method codeContext returns a Detector
Load the comment-pattern for a given file. The file-language is determined by the file-extension.
Params
filename {string}: the name of the filereturns {object}: the comment-patternsLoad the comment-regex for a given file. The result contains a regex that matches the comments in the specification. It also has information about which the different capturing groups of an object.
Params
filename {string}: the name of the filereturns {object}: an object containing regular expressions and capturing-group metadata, see usage example for detailsCreate a new detector. A detector contains a list of parsers which extract the
code context from a list of nodes.
It is an immutable object that can be extended, creating a new instance with more parsers.
Params
Creates an extended Detector with additional parsers. A new instance will be created.
The old Detector remains untouched.
Params
returns {Detector}: a new Detector instancePerform detection. This method calls the included parsers one after another
and returns the first-non-null result. The line-number is returned
as begin-property in the result, but the parser-function can override it.
Params
returns {object}Helper function to create a parser from a regex that matches a string
and a resolver that parses the
Params
returns {function}: a function that can be used as parserThe language-specification can be found in the
languages-directory. There is one file
for each language. The actual databases will be
created from these files on prepublish.
The content of language database can be found here
See the contributing guide
Install dev dependencies:
$ npm i -d && npm test
extract-comments: Uses esprima to extract line and block comments from a string of JavaScript. Also optionally… more | homepage
Nils Knappmeier
Released under the MIT license.
FAQs
A list of comment-patterns for different languages
The npm package comment-patterns receives a total of 9,176 weekly downloads. As such, comment-patterns popularity was classified as popular.
We found that comment-patterns demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.

Security News
Socket CTO Ahmad Nassri shares practical AI coding techniques, tools, and team workflows, plus what still feels noisy and why shipping remains human-led.

Research
/Security News
A five-month operation turned 27 npm packages into durable hosting for browser-run lures that mimic document-sharing portals and Microsoft sign-in, targeting 25 organizations across manufacturing, industrial automation, plastics, and healthcare for credential theft.