Research
Security News
Quasar RAT Disguised as an npm Package for Detecting Vulnerabilities in Ethereum Smart Contracts
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
Transform the ast on a recursive walk.
This modules uses acorn to create an AST from source code.
Put a function wrapper around all array literals.
var falafel = require('falafel');
var src = '(' + function () {
var xs = [ 1, 2, [ 3, 4 ] ];
var ys = [ 5, 6 ];
console.dir([ xs, ys ]);
} + ')()';
var output = falafel(src, function (node) {
if (node.type === 'ArrayExpression') {
node.update('fn(' + node.source() + ')');
}
});
console.log(output);
output:
(function () {
var xs = fn([ 1, 2, fn([ 3, 4 ]) ]);
var ys = fn([ 5, 6 ]);
console.dir(fn([ xs, ys ]));
})()
//@ sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoib3V0LmpzIiwic291cmNlcyI6WyJpbi5qcyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxDQUFDLENBQUEsQ0FBQSxDQUFBLENBQUEsQ0FBQSxDQUFBLENBQUEsQ0FBQSxDQUFBLENBQUEsQ0FBQSxDQUFZLENBQUE7QUFBQSxDQUFBLENBQUEsQ0FBQSxDQUNULENBQUEsQ0FBQSxDQUFBLENBQUksQ0FBQSxDQUFBLENBQUEsQ0FBQSxDQUFLLDBCQUFULENBRFM7QUFBQSxDQUFBLENBQUEsQ0FBQSxDQUVULENBQUEsQ0FBQSxDQUFBLENBQUksQ0FBQSxDQUFBLENBQUEsQ0FBQSxDQUFLLFlBQVQsQ0FGUztBQUFBLENBQUEsQ0FBQSxDQUFBLENBR1QsQ0FBQSxDQUFBLENBQUEsQ0FBQSxDQUFBLENBQUEsQ0FBQSxDQUFRLENBQUEsQ0FBQSxDQUFSLENBQVksY0FBWixDQUFBLENBSFM7QUFBQSxDQUFiLENBQUEsQ0FBQSIsInNvdXJjZXNDb250ZW50IjpbIihmdW5jdGlvbiAoKSB7XG4gICAgdmFyIHhzID0gWyAxLCAyLCBbIDMsIDQgXSBdO1xuICAgIHZhciB5cyA9IFsgNSwgNiBdO1xuICAgIGNvbnNvbGUuZGlyKFsgeHMsIHlzIF0pO1xufSkoKSJdfQ==
var falafel = require('falafel')
Transform the string source src
with the function fn
, returning a
string-like transformed output object.
For every node in the ast, fn(node)
fires. The recursive walk is a
pre-traversal, so children get called before their parents.
Performing a pre-traversal makes it easier to write nested transforms since transforming parents often requires transforming all its children first.
The return value is string-like (it defines .toString()
and .inspect()
) so
that you can call node.update()
asynchronously after the function has
returned and still capture the output.
Instead of passing a src
you can also use opts.source
.
All of the opts
will be passed directly to
acorn.
You may pass in an instance of acorn to the opts as opts.parser
to use that
version instead of the version of acorn packaged with this library.
var acorn = require('acorn-jsx');
falafel(src, {parser: acorn, plugins: { jsx: true }}, function(node) {
// this will parse jsx
});
Aside from the regular esprima data, you can also call some inserted methods on nodes.
Aside from updating the current node, you can also reach into sub-nodes to call update functions on children from parent nodes.
Return the source for the given node, including any modifications made to children nodes.
Return the array of strings and SourceNodes for the given node.
Replace the source nodes for the given node with the arguments to update
,
be they strings or SourceNodes.
To maintain source mappings to children, pass the result of node.sourceNodes()
as one of the arguments to this function. For example:
node.update("[", node.sourceNodes(), "]")
.
Note that in 'ForStatement'
node types, there is an existing subnode called
update
. For those nodes all the properties are copied over onto the
node.update()
function.
Reference to the parent element or null
at the root element.
With npm do:
npm install falafel
MIT
FAQs
transform the ast on a recursive walk
The npm package falafel-sm receives a total of 1 weekly downloads. As such, falafel-sm popularity was classified as not popular.
We found that falafel-sm demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
Security News
Research
A supply chain attack on Rspack's npm packages injected cryptomining malware, potentially impacting thousands of developers.
Research
Security News
Socket researchers discovered a malware campaign on npm delivering the Skuld infostealer via typosquatted packages, exposing sensitive data.