
Research
/Security News
10 npm Typosquatted Packages Deploy Multi-Stage Credential Harvester
Socket researchers found 10 typosquatted npm packages that auto-run on install, show fake CAPTCHAs, fingerprint by IP, and deploy a credential stealer.
esast-util-from-js
Advanced tools
esast (and estree) utility to parse trees from JavaScript.
This package is a utility that turns a string of JavaScript into an esast (estree with some extra cleanliness) syntax tree.
You can use this utility when you want to deal with ASTs of JavaScript
combined with other unist and vfile things.
You can use acorn itself if you don’t care about unified.
The utility estree-util-to-js does the inverse of this
utility.
It turns the tree into a string of JavaScript.
This package is ESM only. In Node.js (version 16+), install with npm:
npm install esast-util-from-js
In Deno with esm.sh:
import {fromJs} from 'https://esm.sh/esast-util-from-js@2'
In browsers with esm.sh:
<script type="module">
import {fromJs} from 'https://esm.sh/esast-util-from-js@2?bundle'
</script>
import fs from 'node:fs/promises'
import {fromJs} from 'esast-util-from-js'
const tree = fromJs(await fs.readFile('example.js'), {module: true})
console.log(tree)
Yields:
{
type: 'Program',
body: [
{
type: 'ImportDeclaration',
specifiers: [Array],
source: [Object],
position: [Object]
},
{
type: 'ImportDeclaration',
specifiers: [Array],
source: [Object],
position: [Object]
},
{
type: 'VariableDeclaration',
declarations: [Array],
kind: 'const',
position: [Object]
},
{
type: 'ExpressionStatement',
expression: [Object],
position: [Object]
}
],
sourceType: 'module',
comments: [],
position: {
start: {line: 1, column: 1, offset: 0},
end: {line: 7, column: 1, offset: 157}
}
}
This package exports the identifier fromJs.
There is no default export.
fromJs(value[, options])Parse JavaScript to an esast.
Tree (Node).
When the JavaScript cannot be parsed with acorn, a
VFileMessage is thrown.
This can for example happen when passing modern syntax (you could maybe use a
newer version, or it might be that the syntax is not yet supported), or just
otherwise invalid JavaScript (you might need a plugin).
OptionsConfiguration (TypeScript type).
versionJavaScript version (Version, default: 'latest').
When a number, must be a year in the range 2015 and 2023 (both including).
'latest' is the same as passing the latest supported year.
☢️ Danger:
'latest'is a sliding thing, you could consider it as breaking semver. Pass an actual year to lock that down.
moduleWhether this is a module (ESM) or a script (boolean, default: false).
allowReturnOutsideFunctionWhether a return statement is allowed in the top scope (boolean, default:
false).
allowImportExportEverywhereWhether import/export statements are allowed in the every scope (boolean,
default: false).
allowAwaitOutsideFunctionWhether await is allowed in the top scope (boolean, default: depends).
Defaults to version >= 2022.
allowSuperOutsideMethodWhether super is allowed outside methods (boolean, default: false).
allowHashBangWhether a shell hasbang is allowed (boolean, default: false).
pluginsList of acorn plugins (Array<Plugin>, default: []).
Examples are acorn-jsx and acorn-stage3.
PluginAcorn plugin (TypeScript type).
type Plugin = (Parser: ParserClass) => ParserClass
ValueInput value (TypeScript type).
When a typed array, must be UTF-8.
type Value = Uint8Array | string
VersionJavaScript version (TypeScript type).
'latest' is equivalent to the latest supported year.
type Version = 2015 | 2016 | 2017 | 2018 | 2019 | 2020 | 2021 | 2022 | 2023 | 'latest'
This package is fully typed with TypeScript.
It exports the additional types Options,
Plugin,
Value, and
Version.
Projects maintained by the unified collective are compatible with maintained versions of Node.js.
When we cut a new major release, we drop support for unmaintained versions of
Node.
This means we try to keep the current release line, esast-util-from-js@^2,
compatible with Node.js 16.
See contributing.md in syntax-tree/.github for
ways to get started.
See support.md for ways to get help.
This project has a code of conduct. By interacting with this repository, organization, or community you agree to abide by its terms.
FAQs
estree (and esast) utility to parse from JavaScript
We found that esast-util-from-js demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Socket researchers found 10 typosquatted npm packages that auto-run on install, show fake CAPTCHAs, fingerprint by IP, and deploy a credential stealer.

Product
Socket Firewall Enterprise is now available with flexible deployment, configurable policies, and expanded language support.

Security News
Open source dashboard CNAPulse tracks CVE Numbering Authorities’ publishing activity, highlighting trends and transparency across the CVE ecosystem.