
Research
SANDWORM_MODE: Shai-Hulud-Style npm Worm Hijacks CI Workflows and Poisons AI Toolchains
An emerging npm supply chain attack that infects repos, steals CI secrets, and targets developer AI toolchains for further compromise.
ingredients
Advanced tools
This is a fork of babylon
ingredients is a JavaScript parser used in recipes.
Heavily based on acorn and acorn-jsx, thanks to the awesome work of @RReverser and @marijnh.
Significant diversions are expected to occur in the future such as streaming, EBNF definitions, sweet.js integration, interspacial parsing and more.
ingredients.parse(code, [options])allowImportExportEverywhere: By default, import and export
declarations can only appear at a program's top level. Setting this
option to true allows them anywhere where a statement is allowed.
allowReturnOutsideFunction: By default, a return statement at
the top level raises an error. Set this to true to accept such
code.
allowSuperOutsideMethod TODO
sourceType: Indicate the mode the code should be parsed in. Can be
either "script" or "module".
sourceFilename: Correlate output AST nodes with their source filename. Useful when generating code and source maps from the ASTs of multiple input files.
plugins: Array containing the plugins that you want to enable.
ingredients generates AST according to Babel AST format. It is based on ESTree spec with the following deviations:
directives field with Directive and DirectiveLiteralAST for JSX code is based on Facebook JSX AST with the addition of one node type:
JSXTextrequire("ingredients").parse("code", {
// parse in strict mode and allow module declarations
sourceType: "module",
plugins: [
// enable jsx and flow syntax
"jsx",
"flow"
]
});
jsxflowdoExpressionsobjectRestSpreaddecoratorsclassPropertiesexportExtensionsasyncGeneratorsfunctionBindfunctionSentFAQs
A JavaScript parser
We found that ingredients demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
An emerging npm supply chain attack that infects repos, steals CI secrets, and targets developer AI toolchains for further compromise.

Company News
Socket is proud to join the OpenJS Foundation as a Silver Member, deepening our commitment to the long-term health and security of the JavaScript ecosystem.

Security News
npm now links to Socket's security analysis on every package page. Here's what you'll find when you click through.