Security News
pnpm 10.0.0 Blocks Lifecycle Scripts by Default
pnpm 10 blocks lifecycle scripts by default to improve security, addressing supply chain attack risks but sparking debate over compatibility and workflow changes.
match-ast
Collection of helper functions to verify a AST tree structure.
Example: verify if a tree represents a JSON.stringify()
call
const {
isCallExpression,
isMemberExpression,
isIdentifier
} = require("match-ast");
// Check if the tree represents a `JSON.stringify()` call.
const isJsonStringify = isCallExpression({
callee: isMemberExpression({
object: isIdentifier("JSON"),
property: isIdentifier("stringify")
})
});
Most functions are named isSomething
where Something
is the type of the node (i.e. isIdentifier
checks if node.type === "Identifier"
). They accept a single argument: an object where keys represent the property of a node and the value is a matcher for that property.
The accepted matchers are: a matcher function, primitive values, arrays or functions.
Calling a function with no arguments means it will only assert its type and none of the properties. For types with no properties (i.e. ThisExpression
), arguments are ignored.
For nodes with only a single property (i.e. Identifier
with property name
), you can pass directly the matcher for that property, so you don't have to pass an object with a single property. For example, isIdentifier("foo")
is equivalent to isIdentifier({ name: "foo" })
.
Passing extra properties to a matcher will make it always return false:
// check() will always return false since there's no `name` property in CallExpression
const check = isCallExpression({ name: "foo" });
either
For cases where a node can be one of many values:
const { either, isIdentifier, isMemberExpression } = require("match-ast");
// Check if the three is a `JSON.stringify()` or `stringify()` call
const isStringify = isCallExpression({
callee: either(
isMemberExpression({
object: isIdentifier("JSON"),
property: isIdentifier("stringify")
}),
isIdentifier("stringify")
)
});
This library consists of helper functions automatically generated on top of the excellent @babel/types
definitions.
FAQs
Helper functions to verify an AST structure
We found that match-ast demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
pnpm 10 blocks lifecycle scripts by default to improve security, addressing supply chain attack risks but sparking debate over compatibility and workflow changes.
Product
Socket now supports uv.lock files to ensure consistent, secure dependency resolution for Python projects and enhance supply chain security.
Research
Security News
Socket researchers have discovered multiple malicious npm packages targeting Solana private keys, abusing Gmail to exfiltrate the data and drain Solana wallets.