
Research
Malicious npm Package Brand-Squats TanStack to Exfiltrate Environment Variables
A brand-squatted TanStack npm package used postinstall scripts to steal .env files and exfiltrate developer secrets to an attacker-controlled endpoint.
mercury-lang
Advanced tools
This Package does not generate any sound or visuals. This package only parses Mercury code and returns a JSON formatted parse tree. This is used in the Mercury environment to translate the code to sound and visual objects. This is also used in the Mercury-Playground, a browser based lite version of the environment.
Mercury is a minimal and human-readable language for the live coding of algorithmic electronic music.
🚀 Go to the full Mercury Project
👾 Or start sketching in the browser:
🙏 Support Mercury by becoming a Patron
git clone and run npm install
Open the mercury.ne file to view the grammar in the Nearley language including the moo tokenizer.
Run npm run build
grammar.js parser file/buildRun a test with npm test and view result in /test/tree
$ npm install mercury-lang
const Mercury = require('mercury-lang');
const Mercury = require('mercury-lang/build/mercury.es5.min.js');
Include latest or specific version of bundled minified es5 through url in index.html
<script src="https://unpkg.com/mercury-lang@1.0.0/build/mercury.es5.min.js"></script>
Use in a html <script> like so:
// entire package
const Mercury = MercuryParser;
A small code file of Mercury below
// A small example for the Mercury parser
set tempo 140
set nonSetting 10
list myBeat euclidean(8 5 1)
new synth saw time(1/8) play(myBeat) name(s1)
give s1 fx(reverb 0.9 7)
list notes random 16 0 12)
Input the code in the Mercury parser
const mercury = require('mercury-lang');
const code = fs.readFileSync('example.txt', 'utf-8');
const result = mercury(code);
The result is a JS object consisting of a parseTree...
console.log(result.parseTree);
{
global: {
tempo: [ 140 ],
scale: [ 'chromatic', 'c' ],
root: [ 'c' ],
randomSeed: [ 0 ],
highPass: [ 20000, 0 ],
lowPass: [ 1, 0 ],
silence: false
},
variables: {
myBeat: [
0, 1, 0, 1,
1, 0, 1, 1
]
},
objects: {
s1: {
object: 'synth',
type: 'saw',
functions: {
group: [],
time: [ '1/8' ],
note: [ 0, 0 ],
env: [ 5, 500 ],
beat: [
[
0, 1, 0, 1,
1, 0, 1, 1
]
],
amp: [ 0.7 ],
wave2: [ 'saw', 0 ],
add_fx: [ [ 'reverb', 0.9, 7 ] ],
name: [ 's1' ]
}
}
},
groups: { all: [ 's1' ] },
print: [],
comments: [ '// A small example for the Mercury parser' ]
}
... a syntaxTree...
console.log(result.syntaxTree);
{
'@main': [
{
'@global': { '@comment': '// A small example for the Mercury parser' }
},
{
'@object': {
'@set': { '@functions': [ { '@number': 140 } ] }
}
},
{
'@list': {
'@name': 'myBeat',
'@params': {
'@function': {
'@name': 'euclidean',
'@args': [ { '@number': 8 }, { '@number': 5 }, { '@number': 1 } ]
}
}
}
},
{
'@object': {
'@new': {
'@type': { '@identifier': 'saw' },
'@functions': [
{
'@function': {
'@name': 'time',
'@args': [ { '@division': '1/8' } ]
}
},
{
'@function': {
'@name': 'beat',
'@args': [ { '@identifier': 'myBeat' } ]
}
},
{
'@function': {
'@name': 'name',
'@args': [ { '@identifier': 's1' } ]
}
}
]
}
}
},
{
'@object': {
'@set': {
'@functions': [
{
'@function': {
'@name': 'add_fx',
'@args': [
{ '@identifier': 'reverb' },
{ '@number': 0.9 },
{ '@number': 7 }
]
}
}
]
}
}
}
]
}
an errors array with encountered syntax errors
"errors": [
"Syntax error at line 9 col 19: Unexpected number: 16 at list notes random 16<-"
]
...and a warnings array with warnings that may cause issues
"warnings" : [
"Warning: Unkown setting name: nonSetting"
]
The GNU GPL-v.3
FAQs
Parser for the mercury live coding language
The npm package mercury-lang receives a total of 119 weekly downloads. As such, mercury-lang popularity was classified as not popular.
We found that mercury-lang demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A brand-squatted TanStack npm package used postinstall scripts to steal .env files and exfiltrate developer secrets to an attacker-controlled endpoint.

Research
Compromised SAP CAP npm packages download and execute unverified binaries, creating urgent supply chain risk for affected developers and CI/CD environments.

Company News
Socket has acquired Secure Annex to expand extension security across browsers, IDEs, and AI tools.