
Security News
Risky Biz Podcast: Making Reachability Analysis Work in Real-World Codebases
This episode explores the hard problem of reachability analysis, from static analysis limits to handling dynamic languages and massive dependency trees.
npm i -g evm2term
Usage: evm2term [options] <json file containing the ast>
Converts an Egg AST to a term representation
Options:
-V, --version output the version number
-i, --indent
-h, --help display help for command
Provides an executable evm2term
that summarizes an AST stored in a json file.
Currently only there is a description file egg-ast-description.js
giving support
to the ASTs provided by the egg
compiler used in the classes of the subject Language Processors:
For instance, for this Egg program:
➜ cat cat examples/summult.egg
+(a,*(4,5))
The AST generated by the any parser is usually a long JSON:
➜ eggc examples/summult.egg
➜ evm2term git:(generic) ✗ cat examples/summult.json
{
"type": "apply",
"operator": {
"type": "word",
"offset": 0,
"lineBreaks": 0,
"line": 1,
"col": 1,
"name": "+"
},
"args": [
{
"type": "word",
"offset": 2,
"lineBreaks": 0,
"line": 1,
"col": 3,
"name": "a"
},
{
"type": "apply",
"operator": {
"type": "word",
"offset": 4,
"lineBreaks": 0,
"line": 1,
"col": 5,
"name": "*"
},
"args": [
{
"type": "value",
"value": 4,
"raw": "4"
},
{
"type": "value",
"value": 5,
"raw": "5"
}
]
}
]
}
You can get the shape of the AST using evm2term
:
✗ evm2term examples/summult.json
apply(op:word{"+"},args:[word{"a"},apply(op:word{"*"},args:[value{4},value{5}])])
Term
is a DSL to summarize ASTs. Here is an attempt to describe the language:
term -> ('NAME' ':')? 'TYPE' '(' term (',' term)* ')'
| leaf
leaf -> ('NAME' ':')? 'TYPE' ('{' 'ATTRIBUTE' '}')?
'NAME'
is the name of the child in the node,'TYPE'
represents the type of the node,'ATTRIBUTE'
is the JSON stringify of a single attribute of the leaf node.To summarize the AST the following rules are followed:
The syntax of the output seems to be legal ruby. You get syntax highlighting by saving the output with the .rb
extension
By adding a configuration JS file following the pattern in egg-ast-description.js, the program can be used to work with different ASTs.
FAQs
Translates from Egg Virtual Machine (JSON) to a summarized AST term
We found that evm2term demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
This episode explores the hard problem of reachability analysis, from static analysis limits to handling dynamic languages and massive dependency trees.
Security News
/Research
Malicious Nx npm versions stole secrets and wallet info using AI CLI tools; Socket’s AI scanner detected the supply chain attack and flagged the malware.
Security News
CISA’s 2025 draft SBOM guidance adds new fields like hashes, licenses, and tool metadata to make software inventories more actionable.