
Research
2025 Report: Destructive Malware in Open Source Packages
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.
Regular expression-like syntax for list operations. An experiment generalizing regex-like operations to a list.
To install the latest stable version of elxr -
yarn add elxr
// OR
npm install --save elxr
Whitespaces are ignored (except within literals)
\s => Any string\n => Any number\b => Any boolean\o => Any object (has to be a record) [TODO]\a => Any array [TODO]\T => Any truthy value\F => Any falsey valuea|b => match a or ba* => Zero or more consecutive instances of pattern a in the lista+ => One or more consecutive instances of pattern a in the lista{2, 5} => Min-Max quantifiers (example matches a more than 2 times but less than 5)(\s\T) => Group (example matches any non-empty string)^a$ => ^ indicates start of list, and $ indicates end of list [TODO]a,b => match a on current item followed by b on the next item (sequence)[name \s\T] => match property of object (example matches items with property name as non-empty string)> n | >= n | < n | <= n => Comparison with literal number [TODO]/pat/ => Test string values against regex"foobar" => String literal (example matches the string foobar)-2.05 => Number literal (example matches the number -2.05)true => Boolean literal (example matches the value true)(?<myMatch> \s\T) => Named capture group (example matches \s\T pattern with the name myMatch) [TODO](?: \s\T) => Non-capturing group (example checks for \s\T but doesn't return it as a match) [TODO]// | Match for any number or any non-empty string or any object with `prop` is true
matchAll(/ \n | \s\T /, [null, 23, '', 'wow', false ]
// > {
// groups: [
// { index: 1, value: 23 }, // \n
// { index: 3, value: 'wow' }, // \s\T
// ]
// }
// | Match for property `seperator` true, followed by one or more list of id's that are non-empty strings
matchAll(/ [seperator true], [id \s\T]+ /, [
{ seperator: true },
{ id: '1' },
{ id: '2' },
{ id: '3' },
{ seperator: true },
{ id: '4' },
{ id: '5' },
{ id: '6' },
])
// > {
// groups: [
// {
// index: 0,
// value: [
// [{ value: { seperator: true }, index: 0 }],
// [{ value: [{ id: '1' }, { id: '2' }, { id: '3' }], index: 1 }],
// ],
// },
// {
// index: 4,
// value: [
// [{ value: { seperator: true }, index: 4 }],
// [{ value: [{ id: '4' }, { id: '5' }, { id: '6' }], index: 5 }],
// ],
// },
// ]
// }
// | Match for any number or any non-empty string or any object with `prop` is true
const replacer = (_, matches) => matches.value.reduce((a, b) => a + b, 0)
replaceAll(/ \n+ /, replacer, [ 'start', 3, 5, 'mid', 2, 0, 4, 'end' ])
// > [ 'start', 8, 'mid', 6, 'end' ]
Elxr is licensed under MIT
FAQs
Regular expression-like syntax generalized for list operations
We found that elxr demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.

Security News
Socket CTO Ahmad Nassri shares practical AI coding techniques, tools, and team workflows, plus what still feels noisy and why shipping remains human-led.

Research
/Security News
A five-month operation turned 27 npm packages into durable hosting for browser-run lures that mimic document-sharing portals and Microsoft sign-in, targeting 25 organizations across manufacturing, industrial automation, plastics, and healthcare for credential theft.