
Security News
/Research
Wallet-Draining npm Package Impersonates Nodemailer to Hijack Crypto Transactions
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
esast-util-from-js
Advanced tools
esast (and estree) utility to parse trees from JavaScript.
This package is a utility that turns a string of JavaScript into an esast (estree with some extra cleanliness) syntax tree.
You can use this utility when you want to deal with ASTs of JavaScript
combined with other unist and vfile
things.
You can use acorn
itself if you don’t care about unified.
The utility estree-util-to-js
does the inverse of this
utility.
It turns the tree into a string of JavaScript.
This package is ESM only. In Node.js (version 16+), install with npm:
npm install esast-util-from-js
In Deno with esm.sh
:
import {fromJs} from 'https://esm.sh/esast-util-from-js@2'
In browsers with esm.sh
:
<script type="module">
import {fromJs} from 'https://esm.sh/esast-util-from-js@2?bundle'
</script>
import fs from 'node:fs/promises'
import {fromJs} from 'esast-util-from-js'
const tree = fromJs(await fs.readFile('example.js'), {module: true})
console.log(tree)
Yields:
{
type: 'Program',
body: [
{
type: 'ImportDeclaration',
specifiers: [Array],
source: [Object],
position: [Object]
},
{
type: 'ImportDeclaration',
specifiers: [Array],
source: [Object],
position: [Object]
},
{
type: 'VariableDeclaration',
declarations: [Array],
kind: 'const',
position: [Object]
},
{
type: 'ExpressionStatement',
expression: [Object],
position: [Object]
}
],
sourceType: 'module',
comments: [],
position: {
start: {line: 1, column: 1, offset: 0},
end: {line: 7, column: 1, offset: 157}
}
}
This package exports the identifier fromJs
.
There is no default export.
fromJs(value[, options])
Parse JavaScript to an esast.
Tree (Node
).
When the JavaScript cannot be parsed with acorn
, a
VFileMessage
is thrown.
This can for example happen when passing modern syntax (you could maybe use a
newer version
, or it might be that the syntax is not yet supported), or just
otherwise invalid JavaScript (you might need a plugin).
Options
Configuration (TypeScript type).
version
JavaScript version (Version
, default: 'latest'
).
When a number, must be a year in the range 2015
and 2023
(both including).
'latest'
is the same as passing the latest supported year.
☢️ Danger:
'latest'
is a sliding thing, you could consider it as breaking semver. Pass an actual year to lock that down.
module
Whether this is a module (ESM) or a script (boolean
, default: false
).
allowReturnOutsideFunction
Whether a return statement is allowed in the top scope (boolean
, default:
false
).
allowImportExportEverywhere
Whether import/export statements are allowed in the every scope (boolean
,
default: false
).
allowAwaitOutsideFunction
Whether await
is allowed in the top scope (boolean
, default: depends).
Defaults to version >= 2022
.
allowSuperOutsideMethod
Whether super
is allowed outside methods (boolean
, default: false
).
allowHashBang
Whether a shell hasbang is allowed (boolean
, default: false
).
plugins
List of acorn plugins (Array<Plugin>
, default: []
).
Examples are acorn-jsx
and acorn-stage3
.
Plugin
Acorn plugin (TypeScript type).
type Plugin = (Parser: ParserClass) => ParserClass
Value
Input value (TypeScript type).
When a typed array, must be UTF-8.
type Value = Uint8Array | string
Version
JavaScript version (TypeScript type).
'latest'
is equivalent to the latest supported year.
type Version = 2015 | 2016 | 2017 | 2018 | 2019 | 2020 | 2021 | 2022 | 2023 | 'latest'
This package is fully typed with TypeScript.
It exports the additional types Options
,
Plugin
,
Value
, and
Version
.
Projects maintained by the unified collective are compatible with maintained versions of Node.js.
When we cut a new major release, we drop support for unmaintained versions of
Node.
This means we try to keep the current release line, esast-util-from-js@^2
,
compatible with Node.js 16.
See contributing.md
in syntax-tree/.github
for
ways to get started.
See support.md
for ways to get help.
This project has a code of conduct. By interacting with this repository, organization, or community you agree to abide by its terms.
FAQs
estree (and esast) utility to parse from JavaScript
The npm package esast-util-from-js receives a total of 928,943 weekly downloads. As such, esast-util-from-js popularity was classified as popular.
We found that esast-util-from-js demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
/Research
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
Security News
This episode explores the hard problem of reachability analysis, from static analysis limits to handling dynamic languages and massive dependency trees.
Security News
/Research
Malicious Nx npm versions stole secrets and wallet info using AI CLI tools; Socket’s AI scanner detected the supply chain attack and flagged the malware.