
Research
/Security News
9 Malicious NuGet Packages Deliver Time-Delayed Destructive Payloads
Socket researchers discovered nine malicious NuGet packages that use time-delayed payloads to crash applications and corrupt industrial control systems.
estree-util-scope
Advanced tools
estree utility to check what’s defined in a scope.
This package is a utility that tracks what’s defined in a scope.
If you are walking an estree already and want to find out what’s defined,
use this.
If you have more complex scoping needs,
see eslint-scope.
This package is ESM only. In Node.js (version 16+), install with npm:
npm install estree-util-scope
In Deno with esm.sh:
import {createVisitors} from 'https://esm.sh/estree-util-scope@1'
In browsers with esm.sh:
<script type="module">
import {createVisitors} from 'https://esm.sh/estree-util-scope@1?bundle'
</script>
Say we have the following example.js:
/**
* @import {Program} from 'estree'
*/
import {Parser} from 'acorn'
import {createVisitors} from 'estree-util-scope'
import {walk} from 'estree-walker'
const tree = /** @type {Program} */ (
Parser.parse('import {a} from "b"; const c = 1', {
ecmaVersion: 'latest',
sourceType: 'module'
})
)
const visitors = createVisitors()
walk(tree, {enter: visitors.enter, leave: visitors.exit})
console.log(visitors.scopes.at(-1))
…now running node example.js yields:
{ block: false, defined: [ 'a', 'c' ] }
ScopeScope.
block (boolean)
— whether this is a block scope or not;
blocks are things made by for and try and if;
non-blocks are functions and the top-level scopedefined (Array<string>)
— identifiers that are defined in this scopeVisitorsState to track what’s defined;
contains enter, exit callbacks you must call and scopes.
enter ((node: Node) => undefined)
— callback you must call when entering a nodeexit ((node: Node) => undefined)
— callback you must call when exiting (leaving) a nodescopes ([topLevel: Scope, ...rest: Scope[]])
— list of scopes;
the first scope is the top-level scope;
the last scope is the current scopecreateVisitors()Create state to track what’s defined.
There are no parameters.
State (Visitors).
Sometimes, you only care about a top-scope.
Or otherwise want to skip a node.
How to do this depends on how you walk the tree.
With estree-walker,
you can skip by calling this.skip.
/**
* @import {Program} from 'estree'
*/
import {Parser} from 'acorn'
import {createVisitors} from 'estree-util-scope'
import {walk} from 'estree-walker'
const tree = /** @type {Program} */ (
Parser.parse(
'function a(b) { var c = 1; if (d) { var e = 2 } }; if (f) { var g = 2 }',
{ecmaVersion: 'latest'}
)
)
const visitors = createVisitors()
walk(tree, {
enter(node) {
visitors.enter(node)
if (
node.type === 'ArrowFunctionExpression' ||
node.type === 'FunctionDeclaration' ||
node.type === 'FunctionExpression'
) {
this.skip()
visitors.exit(node) // Call the exit handler manually.
}
},
leave: visitors.exit
})
console.log(visitors.scopes.at(-1))
…yields:
{ block: false, defined: [ 'a', 'g' ] }
Projects maintained by the unified collective are compatible with maintained versions of Node.js.
When we cut a new major release, we drop support for unmaintained versions of
Node.
This means we try to keep the current release line, estree-util-scope@1,
compatible with Node.js 16.
This package is safe.
See contributing.md in syntax-tree/.github for ways to get
started.
See support.md for ways to get help.
This project has a code of conduct. By interacting with this repository, organization, or community you agree to abide by its terms.
FAQs
Check what’s defined in an estree scope
The npm package estree-util-scope receives a total of 1,178,259 weekly downloads. As such, estree-util-scope popularity was classified as popular.
We found that estree-util-scope demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Socket researchers discovered nine malicious NuGet packages that use time-delayed payloads to crash applications and corrupt industrial control systems.

Security News
Socket CTO Ahmad Nassri discusses why supply chain attacks now target developer machines and what AI means for the future of enterprise security.

Security News
Learn the essential steps every developer should take to stay secure on npm and reduce exposure to supply chain attacks.