
Research
Two Malicious Rust Crates Impersonate Popular Logger to Steal Wallet Keys
Socket uncovers malicious Rust crates impersonating fast_log to steal Solana and Ethereum wallet keys from source code.
gonzales-ast
Advanced tools
This is library to help navigate CSS AST produced by the Gonzales CSS parser
$ npm install gonzales-ast
Gonzales eats CSS and spits AST. It also eats AST and spits CSS.
But it doesn't have an API for AST-to-AST manipulations.
Additionally, this library makes the Gonzales' APIs a little more sensible (in the author's opinion).
E.g. the srcToCSSP()
method is available as parse()
.
Currently this library offers:
traverse()
to walk the AST and visit each nodeSimple usage:
var gonzo = require('gonzales-ast');
var ast = gonzo.parse('a {margin: 0}'); // formerly `srcToCSSP()`
var css_string = gonzo.toCSS(ast); // formerly `csspToSrc()`
There's also toTree()
(formerly csspToTree()
) that shows a formatted view of the AST.
gonzo.toTree(ast);
Returns the string:
['stylesheet',
['ruleset',
['selector',
['simpleselector',
['ident', 'a'],
['s', ' ']]],
['block',
['declaration',
['property',
['ident', 'margin']],
['value',
['s', ' '],
['number', '0']]]]]]
When traversing the AST you can provide any number of "visitors" that take a node and look at it, and maybe do something with it.
Like:
var newast = gonzo.traverse(ast, [
visitor1,
visitor2,
{
test: function(name, nodes) {
return true;
},
process: function(node) {
return node;
}
}
]);
Each visitor must provide a process()
method which returns a node or false
(which removes the node from the tree)
A visitor may provide an optional test()
method which is a lightweight way to see whether or not the process()
method should be called. test()
methods return boolean.
See the examples
directory for an examples of visitors that add, remove and change nodes.
To admire the AST that Gonzales produces, check this out.
FAQs
Gonzales' CSS AST traversal
We found that gonzales-ast demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Socket uncovers malicious Rust crates impersonating fast_log to steal Solana and Ethereum wallet keys from source code.
Research
A malicious package uses a QR code as steganography in an innovative technique.
Research
/Security News
Socket identified 80 fake candidates targeting engineering roles, including suspected North Korean operators, exposing the new reality of hiring as a security function.