Security News
pnpm 10.0.0 Blocks Lifecycle Scripts by Default
pnpm 10 blocks lifecycle scripts by default to improve security, addressing supply chain attack risks but sparking debate over compatibility and workflow changes.
eslint-scope
Advanced tools
The eslint-scope npm package is used to analyze the scope of variables within JavaScript code. It is part of the ESLint family of tools and is used to determine where variables are declared and how they are used throughout the code. This can be particularly useful for identifying issues with variable shadowing, undeclared variables, or potential scope leaks.
Analyzing variable scope in a JavaScript file
This code sample demonstrates how to use eslint-scope to analyze the scope of variables in a JavaScript file. It reads the file, parses it into an AST (Abstract Syntax Tree) using espree, and then analyzes the scope with eslint-scope. The resulting globalScope object contains information about the variables and references in the global scope of the file.
const eslintScope = require('eslint-scope');
const espree = require('espree');
const fs = require('fs');
const code = fs.readFileSync('myfile.js', 'utf8');
const ast = espree.parse(code, { ecmaVersion: 6 });
const scopeManager = eslintScope.analyze(ast);
const globalScope = scopeManager.globalScope;
// Inspect the variables and references in the global scope
console.log(globalScope.variables);
console.log(globalScope.references);
Escope is another scope analysis tool for JavaScript. It is similar to eslint-scope but is no longer actively maintained. Escope was the predecessor to eslint-scope and served a similar purpose in analyzing variable scope within JavaScript code.
Jscodeshift is a toolkit for running codemods over multiple JavaScript or TypeScript files. It uses a different approach but can be used for similar scope analysis and transformation tasks. Jscodeshift provides a more extensive API for manipulating the AST and is often used for large-scale codebase refactors.
Babel-traverse allows you to traverse and manipulate the AST generated by Babel. While its primary use is for Babel plugins and transformations, it can also be used to analyze scope and variable declarations in a manner similar to eslint-scope. Babel-traverse is part of the larger Babel ecosystem, which is widely used for JavaScript compilation and transformation.
ESLint Scope is the ECMAScript scope analyzer used in ESLint. It is a fork of escope.
npm i eslint-scope --save
To use in an ESM file:
import * as eslintScope from 'eslint-scope';
To use in a CommonJS file:
const eslintScope = require('eslint-scope');
In order to analyze scope, you'll need to have an ESTree compliant AST structure to run it on. The primary method is eslintScope.analyze()
, which takes two arguments:
ast
- the ESTree-compliant AST structure to analyze.options
(optional) - Options to adjust how the scope is analyzed, including:ignoreEval
(default: false
) - Set to true
to ignore all eval()
calls (which would normally create scopes).nodejsScope
(default: false
) - Set to true
to create a top-level function scope needed for CommonJS evaluation.impliedStrict
(default: false
) - Set to true
to evaluate the code in strict mode even outside of modules and without "use strict"
.ecmaVersion
(default: 5
) - The version of ECMAScript to use to evaluate the code.sourceType
(default: "script"
) - The type of JavaScript file to evaluate. Change to "module"
for ECMAScript module code.childVisitorKeys
(default: null
) - An object with visitor key information (like eslint-visitor-keys
). Without this, eslint-scope
finds child nodes to visit algorithmically. Providing this option is a performance enhancement.fallback
(default: "iteration"
) - The strategy to use when childVisitorKeys
is not specified. May be a function.Example:
import * as eslintScope from 'eslint-scope';
import * as espree from 'espree';
import estraverse from 'estraverse';
const options = {
ecmaVersion: 2022,
sourceType: "module"
};
const ast = espree.parse(code, { range: true, ...options });
const scopeManager = eslintScope.analyze(ast, options);
const currentScope = scopeManager.acquire(ast); // global scope
estraverse.traverse(ast, {
enter (node, parent) {
// do stuff
if (/Function/.test(node.type)) {
currentScope = scopeManager.acquire(node); // get current function scope
}
},
leave(node, parent) {
if (/Function/.test(node.type)) {
currentScope = currentScope.upper; // set to parent scope
}
// do stuff
}
});
Issues and pull requests will be triaged and responded to as quickly as possible. We operate under the ESLint Contributor Guidelines, so please be sure to read them before contributing. If you're not sure where to dig in, check out the issues.
We work hard to ensure that ESLint Scope is safe for everyone and that security issues are addressed quickly and responsibly. Read the full security policy.
npm test
- run all linting and testsnpm run lint
- run all lintingESLint Scope is licensed under a permissive BSD 2-clause license.
The following companies, organizations, and individuals support ESLint's ongoing maintenance and development. Become a Sponsor to get your logo on our READMEs and website.
FAQs
ECMAScript scope analyzer for ESLint
The npm package eslint-scope receives a total of 65,651,415 weekly downloads. As such, eslint-scope popularity was classified as popular.
We found that eslint-scope demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 4 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
pnpm 10 blocks lifecycle scripts by default to improve security, addressing supply chain attack risks but sparking debate over compatibility and workflow changes.
Product
Socket now supports uv.lock files to ensure consistent, secure dependency resolution for Python projects and enhance supply chain security.
Research
Security News
Socket researchers have discovered multiple malicious npm packages targeting Solana private keys, abusing Gmail to exfiltrate the data and drain Solana wallets.