
Research
/Security News
9 Malicious NuGet Packages Deliver Time-Delayed Destructive Payloads
Socket researchers discovered nine malicious NuGet packages that use time-delayed payloads to crash applications and corrupt industrial control systems.
pug-parser
Advanced tools
The pug parser (takes an array of tokens and converts it to an abstract syntax tree)
The pug parser (takes an array of tokens and converts it to an abstract syntax tree)
npm install pug-parser
var parse = require('pug-parser');
parse(tokens, options)Convert Pug tokens to an abstract syntax tree (AST).
options can contain the following properties:
filename (string): The name of the Pug file; it is included in the produced AST nodes and error handling, if provided.plugins (array): An array of plugins, in the order they should be applied.src (string): The source of the Pug file; it is used in error handling if provided.var lex = require('pug-lexer');
var filename = 'my-file.pug';
var src = 'div(data-foo="bar")';
var tokens = lex(src, {filename});
var ast = parse(tokens, {filename, src});
console.log(JSON.stringify(ast, null, ' '))
{
"type": "Block",
"nodes": [
{
"type": "Tag",
"name": "div",
"selfClosing": false,
"block": {
"type": "Block",
"nodes": [],
"line": 1,
"filename": "my-file.pug"
},
"attrs": [
{
"name": "data-foo",
"val": "\"bar\"",
"line": 1,
"column": 5,
"filename": "my-file.pug",
"mustEscape": true
}
],
"attributeBlocks": [],
"isInline": false,
"line": 1,
"column": 1,
"filename": "my-file.pug"
}
],
"line": 0,
"filename": "my-file.pug"
}
new parse.Parser(tokens, options)Constructor for a Parser class. This is not meant to be used directly unless you know what you are doing.
options may contain the following properties:
filename (string): The name of the Pug file; it is included in the produced AST nodes and error handling, if provided.plugins (array): An array of plugins, in the order they should be applied.src (string): The source of the Pug file; it is used in error handling if provided.MIT
The 'pug' package is the main package for the Pug templating language. It includes both the parser and the compiler, allowing you to convert Pug templates directly into HTML. Unlike pug-parser, which only handles parsing, the 'pug' package provides a complete solution for working with Pug templates.
The 'jade' package is the former name of the Pug templating language. It provides similar functionality to the 'pug' package, including parsing and compiling templates. However, it has been deprecated in favor of 'pug'.
The 'ejs' package is another templating language for JavaScript. It allows you to embed JavaScript code within your templates. While it does not use the same syntax as Pug, it provides similar functionality for generating HTML from templates.
FAQs
The pug parser (takes an array of tokens and converts it to an abstract syntax tree)
The npm package pug-parser receives a total of 1,486,719 weekly downloads. As such, pug-parser popularity was classified as popular.
We found that pug-parser demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Socket researchers discovered nine malicious NuGet packages that use time-delayed payloads to crash applications and corrupt industrial control systems.

Security News
Socket CTO Ahmad Nassri discusses why supply chain attacks now target developer machines and what AI means for the future of enterprise security.

Security News
Learn the essential steps every developer should take to stay secure on npm and reduce exposure to supply chain attacks.