
Research
2025 Report: Destructive Malware in Open Source Packages
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.
esutils (esutils) is utility box for ECMAScript language tools.
Returns true if node is an Expression as defined in ECMA262 edition 5.1 section
11.
Returns true if node is a Statement as defined in ECMA262 edition 5.1 section
12.
Returns true if node is an IterationStatement as defined in ECMA262 edition
5.1 section 12.6.
Returns true if node is a SourceElement as defined in ECMA262 edition 5.1
section 14.
Returns Statement? if node has trailing Statement.
if (cond)
consequent;
When taking this IfStatement, returns consequent; statement.
Returns true if node is a problematic IfStatement. If node is a problematic IfStatement, node cannot be represented as an one on one JavaScript code.
{
type: 'IfStatement',
consequent: {
type: 'WithStatement',
body: {
type: 'IfStatement',
consequent: {type: 'EmptyStatement'}
}
},
alternate: {type: 'EmptyStatement'}
}
The above node cannot be represented as a JavaScript code, since the top level else alternate belongs to an inner IfStatement.
Return true if provided code is decimal digit.
Return true if provided code is hexadecimal digit.
Return true if provided code is octal digit.
Return true if provided code is white space. White space characters are formally defined in ECMA262.
Return true if provided code is line terminator. Line terminator characters are formally defined in ECMA262.
Return true if provided code can be the first character of ECMA262 Identifier. They are formally defined in ECMA262.
Return true if provided code can be the trailing character of ECMA262 Identifier. They are formally defined in ECMA262.
Returns true if provided identifier string is a Keyword or Future Reserved Word
in ECMA262 edition 5.1. They are formally defined in ECMA262 sections
7.6.1.1 and 7.6.1.2,
respectively. If the strict flag is truthy, this function additionally checks whether
id is a Keyword or Future Reserved Word under strict mode.
Returns true if provided identifier string is a Keyword or Future Reserved Word
in ECMA262 edition 6. They are formally defined in ECMA262 sections
11.6.2.1 and
11.6.2.2,
respectively. If the strict flag is truthy, this function additionally checks whether
id is a Keyword or Future Reserved Word under strict mode.
Returns true if provided identifier string is a Reserved Word in ECMA262 edition 5.1.
They are formally defined in ECMA262 section 7.6.1.
If the strict flag is truthy, this function additionally checks whether id
is a Reserved Word under strict mode.
Returns true if provided identifier string is a Reserved Word in ECMA262 edition 6.
They are formally defined in ECMA262 section 11.6.2.
If the strict flag is truthy, this function additionally checks whether id
is a Reserved Word under strict mode.
Returns true if provided identifier string is one of eval or arguments.
They are restricted in strict mode code throughout ECMA262 edition 5.1 and
in ECMA262 edition 6 section 12.1.1.
Return true if provided identifier string is an IdentifierName as specified in ECMA262 edition 5.1 section 7.6.
Return true if provided identifier string is an Identifier as specified in
ECMA262 edition 5.1 section 7.6. If the strict
flag is truthy, this function additionally checks whether id is an Identifier
under strict mode.
Return true if provided identifier string is an Identifier as specified in
ECMA262 edition 6 section 12.1.
If the strict flag is truthy, this function additionally checks whether id
is an Identifier under strict mode.
Copyright (C) 2013 Yusuke Suzuki (twitter: @Constellation) and other contributors.
Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
Acorn is a small, fast, JavaScript-based JavaScript parser. It provides a similar AST-related utility but with a focus on parsing JavaScript code into an AST.
Estraverse is a library for traversing and updating the AST. It is similar to esutils in that it deals with ASTs but focuses more on traversal and modification rather than validation.
JSHint is a tool that helps to detect errors and potential problems in JavaScript code. While it is not a utility library like esutils, it performs validation of JavaScript code, which is one of the functionalities provided by esutils.
FAQs
utility box for ECMAScript language tools
The npm package esutils receives a total of 21,726,239 weekly downloads. As such, esutils popularity was classified as popular.
We found that esutils demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.

Security News
Socket CTO Ahmad Nassri shares practical AI coding techniques, tools, and team workflows, plus what still feels noisy and why shipping remains human-led.

Research
/Security News
A five-month operation turned 27 npm packages into durable hosting for browser-run lures that mimic document-sharing portals and Microsoft sign-in, targeting 25 organizations across manufacturing, industrial automation, plastics, and healthcare for credential theft.