Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
estree-util-scope
Advanced tools
estree utility to check what’s defined in a scope.
This package is a utility that tracks what’s defined in a scope.
If you are walking an estree already and want to find out what’s defined,
use this.
If you have more complex scoping needs,
see eslint-scope
.
This package is ESM only. In Node.js (version 16+), install with npm:
npm install estree-util-scope
In Deno with esm.sh
:
import {createVisitors} from 'https://esm.sh/estree-util-scope@1'
In browsers with esm.sh
:
<script type="module">
import {createVisitors} from 'https://esm.sh/estree-util-scope@1?bundle'
</script>
Say we have the following example.js
:
/**
* @import {Program} from 'estree'
*/
import {Parser} from 'acorn'
import {createVisitors} from 'estree-util-scope'
import {walk} from 'estree-walker'
const tree = /** @type {Program} */ (
Parser.parse('import {a} from "b"; const c = 1', {
ecmaVersion: 'latest',
sourceType: 'module'
})
)
const visitors = createVisitors()
walk(tree, {enter: visitors.enter, leave: visitors.exit})
console.log(visitors.scopes.at(-1))
…now running node example.js
yields:
{ block: false, defined: [ 'a', 'c' ] }
Scope
Scope.
block
(boolean
)
— whether this is a block scope or not;
blocks are things made by for
and try
and if
;
non-blocks are functions and the top-level scopedefined
(Array<string>
)
— identifiers that are defined in this scopeVisitors
State to track what’s defined;
contains enter
, exit
callbacks you must call and scopes
.
enter
((node: Node) => undefined
)
— callback you must call when entering a nodeexit
((node: Node) => undefined
)
— callback you must call when exiting (leaving) a nodescopes
([topLevel: Scope, ...rest: Scope[]]
)
— list of scopes;
the first scope is the top-level scope;
the last scope is the current scopecreateVisitors()
Create state to track what’s defined.
There are no parameters.
State (Visitors
).
Sometimes, you only care about a top-scope.
Or otherwise want to skip a node.
How to do this depends on how you walk the tree.
With estree-walker
,
you can skip by calling this.skip
.
/**
* @import {Program} from 'estree'
*/
import {Parser} from 'acorn'
import {createVisitors} from 'estree-util-scope'
import {walk} from 'estree-walker'
const tree = /** @type {Program} */ (
Parser.parse(
'function a(b) { var c = 1; if (d) { var e = 2 } }; if (f) { var g = 2 }',
{ecmaVersion: 'latest'}
)
)
const visitors = createVisitors()
walk(tree, {
enter(node) {
visitors.enter(node)
if (
node.type === 'ArrowFunctionExpression' ||
node.type === 'FunctionDeclaration' ||
node.type === 'FunctionExpression'
) {
this.skip()
visitors.exit(node) // Call the exit handler manually.
}
},
leave: visitors.exit
})
console.log(visitors.scopes.at(-1))
…yields:
{ block: false, defined: [ 'a', 'g' ] }
Projects maintained by the unified collective are compatible with maintained versions of Node.js.
When we cut a new major release, we drop support for unmaintained versions of
Node.
This means we try to keep the current release line, estree-util-scope@1
,
compatible with Node.js 16.
This package is safe.
See contributing.md
in syntax-tree/.github
for ways to get
started.
See support.md
for ways to get help.
This project has a code of conduct. By interacting with this repository, organization, or community you agree to abide by its terms.
FAQs
Check what’s defined in an estree scope
The npm package estree-util-scope receives a total of 196,272 weekly downloads. As such, estree-util-scope popularity was classified as popular.
We found that estree-util-scope demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.