Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
A 100% compliant, self-hosted javascript parser with high focus on both performance and stability
Meriyah is a fast and lightweight JavaScript parser that supports the latest ECMAScript standards. It is designed to be highly performant and can be used for various tasks such as syntax analysis, code transformation, and static code analysis.
Parsing JavaScript Code
This feature allows you to parse JavaScript code into an Abstract Syntax Tree (AST). The code sample demonstrates how to parse a simple JavaScript statement and log the resulting AST.
const meriyah = require('meriyah');
const ast = meriyah.parseScript('const x = 10;');
console.log(ast);
Parsing with Options
Meriyah supports various parsing options such as module parsing and JSX syntax. The code sample shows how to parse a script with these options enabled.
const meriyah = require('meriyah');
const ast = meriyah.parseScript('const x = 10;', { module: true, jsx: true });
console.log(ast);
Error Handling
Meriyah provides error handling capabilities to catch and handle syntax errors during parsing. The code sample demonstrates how to catch a parsing error and log the error message.
const meriyah = require('meriyah');
try {
const ast = meriyah.parseScript('const x = ;');
} catch (e) {
console.error('Parsing error:', e.message);
}
Acorn is a small, fast, JavaScript-based JavaScript parser. It is known for its modularity and flexibility, allowing users to extend its functionality with plugins. Compared to Meriyah, Acorn is more extensible but may be slightly slower in performance.
Esprima is a high-performance, standard-compliant ECMAScript parser. It is widely used in various JavaScript tools and frameworks. Esprima is known for its accuracy and reliability, but Meriyah is generally faster and more lightweight.
100% compliant, self-hosted javascript parser with high focus on both performance and stability. Stable and already used in production.
Interactive Playground Benchmark
These features need to be enabled with the next
option.
Meriyah doesn't parse RegExp internal syntax, ESTree spec didn't require internal structure of RegExp. Meriyah does use JavaScript runtime to validate the RegExp literal. That means Meriyah's RegExp support is only as good as JavaScript runtime's RegExp support.
As of Auguest 2024, some latest RegExp features are not supported due to missing implementation in general JavaScript runtime.
In addition, RegExp v flag (unicodeSets) only works on Nodejs v20+ and latest browsers.
npm install meriyah --save-dev
Meriyah generates AST
according to ESTree AST format, and can be used to perform syntactic analysis (parsing) of a JavaScript program, and with ES2015
and later a JavaScript program can be either a script or a module.
The parse
method exposed by meriyah takes an optional options
object which allows you to specify whether to parse in script
mode (the default) or in module
mode.
// There are also "parseScript" and "parseModule" exported.
import { parse } from 'meriyah';
const result = parse('let some = "code";', { ranges: true });
The available options:
{
// The flag to allow module code
module: false;
// The flag to enable stage 3 support (ESNext)
next: false;
// The flag to enable start, end offsets and range: [start, end] to each node
ranges: false;
// Enable web compatibility
webcompat: false;
// The flag to enable line/column location information to each node
loc: false;
// The flag to attach raw property to each literal and identifier node
raw: false;
// The flag to allow return in the global scope
globalReturn: false;
// The flag to enable implied strict mode
impliedStrict: false;
// Allows comment extraction. Accepts either a function or array
onComment: [];
// Allows detection of automatic semicolon insertion. Accepts a callback function that will be passed the charater offset where the semicolon was inserted
onInsertedSemicolon: (pos) => {};
// Allows token extraction. Accepts either a function or array
onToken: [];
// Enable non-standard parenthesized expression node
preserveParens: false;
// Enable lexical binding and scope tracking
lexical: false;
// Adds a source attribute in every node’s loc object when the locations option is `true`
source: undefined; // Set to source: 'source-file.js'
// Enable React JSX parsing
jsx: false;
}
If an array is supplied, comments/tokens will be pushed to the array, the item in the array contains start/end/range
information when ranges flag is true, it will also contain loc
information when loc flag is true.
If a function callback is supplied, the signature must be
declare function onComment(type: string, value: string, start: number, end: number, loc: SourceLocation): void;
declare function onToken(token: string, start: number, end: number, loc: SourceLocation): void;
Note the start/end/loc
information are provided to the function callback regardless of the settings on ranges and loc flags. onComment callback has one extra argument value: string
for the body string of the comment.
If a function callback is supplied, the signature must be
declare function onInsertedSemicolon(position: number): void;
import { parseScript } from './meriyah';
parseScript('({x: [y] = 0} = 1)');
This will return when serialized in json:
{
type: "Program",
sourceType: "script",
body: [
{
type: "ExpressionStatement",
expression: {
type: "AssignmentExpression",
left: {
type: "ObjectPattern",
properties: [
{
type: "Property",
key: {
type: "Identifier",
name: "x"
},
value: {
type: "AssignmentPattern",
left: {
type: "ArrayPattern",
elements: [
{
"type": "Identifier",
"name": "y"
}
]
},
right: {
type: "Literal",
value: 0
}
},
kind: "init",
computed: false,
method: false,
shorthand: false
}
]
},
operator: "=",
right: {
type: "Literal",
value: 1
}
}
}
]
}
FAQs
A 100% compliant, self-hosted javascript parser with high focus on both performance and stability
The npm package meriyah receives a total of 162,968 weekly downloads. As such, meriyah popularity was classified as popular.
We found that meriyah demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.