Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
This package parses a JSON into CST (Concrete Syntax Tree), similar to an AST but more low-level and with ties to the lexer tokens. It uses json-lexer
to parse the file into tokens. The speed is practically the same as json-to-ast
(it's ~10% faster than json-to-ast
), but it's far smaller (even including json-lexer
). Pure package is 7x smaller, install size 12x smaller, bundling it makes it 6x smaller according to bundlephobia (json-to-ast vs json-cst).
It comes with TypeScript typings.
npm i json-cst
or yarn add json-cst
This is a pure ESM package, and requires Node.js >=14.13.1
The package exports parse(json: string, options: ParseCstOptions): CstNode
.
options
is an optional object which can contain includeValueTokens: true
to include the value tokens in the result, meaning, for objects and arrays, they will include the slice of tokens for the beginning and end of the object/array.
The tokens are parsed into a hierarchy of nodes, each with a "kind" property:
type CstKindLiteral = 'literal'; // null, true, false
type CstKindNumber = 'number';
type CstKindString = 'string';
type CstKindObjectPropertyColon = 'object-property-colon';
type CstKindObjectProperty = 'object-property';
type CstKindObject = 'object';
type CstKindArrayElement = 'array-element';
type CstKindArray = 'array';
And the CstNode
returned by parse()
is a CstValueNode
, i.e. one of:
CstNodeLiteral
CstNodeNumber
CstNodeString
CstNodeObject
CstNodeArray
Other nodes are:
CstNodeObjectProperty
CstNodeObjectPropertyColon
CstNodeArrayElement
Each token contain a { range: CstTokenRange }
where
interface CstTokenRange {
start: number;
end: number;
}
Each of the primitive tokens CstNodeLiteral
, CstNodeNumber
and CstNodeString
contain { token: Token }
being the raw token from json-lexer
.
Object and array tokens CstNodeObject
and CstNodeArray
contain a property children
being an array of either CstNodeObjectProperty
or CstNodeArrayElement
.
A CstNodeObjectProperty
has a keyToken
property being the lexer token for the property name, and a valueNode
being a CstNode
. A CstNodeArrayElement
also has a valueNode
.
See types.ts
for exact typings.
FAQs
Parse JSON into CST (Concrete Syntax Tree)
The npm package json-cst receives a total of 14,468 weekly downloads. As such, json-cst popularity was classified as popular.
We found that json-cst demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.