
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
Based on the Latin word quis, this project, like its origin, implies a question of existing complex data. Quis provides a lightweight domain specific language (DSL) for performing comparisons on values within a collection using a custom AST (Abstract Syntax Tree) parser built from scratch for optimal performance and minimal bundle size.
== / is Equality.!= / is not Inequality.> / gt Greater than.< / lt Less than.<= / lte Less than or equal.>= / gte Greater than or equal.&& / AND / and Boolean AND|| / OR / or Boolean OR! Boolean NOT (negation)Quis supports complex boolean expressions with proper operator precedence:
$user.health > 50 && $user.level >= 5 - AND has higher precedence$user.magic < 10 || $user.strength > 80 - OR has lower precedence($user.health > 30 && $user.magic > 10) || $inventory.potion == true - Parentheses for groupingTo be as lightweight as possible, Quis does not contain state or database functionality. This must be provided by developers while also matching the expected callback structure.
The AST parser processes expressions through three phases: Tokenization → Parsing → Evaluation. During evaluation, Quis expects a values() callback function returning values based on the passed-in variable name. For example, a simple collection returning specific values based on labels might be the following:
const values = (name) => {
// Establish a default value.
let result = null;
// Return value based on 'example'.
if (name === 'example') {
result = 2;
}
// Return value based on 'example2'.
if (name === 'example2') {
result = 5;
}
// Return object for key-value access examples.
if (name === 'user') {
result = {
name: 'John',
age: 25,
profile: {
score: 100,
level: 'advanced'
}
};
}
// Return either default or set value.
return result;
};
Quis uses a custom-built AST (Abstract Syntax Tree) parser designed for optimal performance and minimal bundle size. The parsing process consists of three distinct phases:
The Tokenizer breaks down the input expression string into a sequence of tokens (numbers, strings, variables, operators, keywords, etc.). Each token includes its type, value, and position for precise error reporting.
The Parser processes the token sequence and builds an Abstract Syntax Tree that respects operator precedence and handles complex nested expressions. It supports:
+, -, *, /)==, !=, >, <, >=, <=, is, is not)and, or, not, &&, ||, !)The Evaluator traverses the AST and computes the final result by calling the provided values function for variable resolution and executing the appropriate operations.
This three-phase architecture provides:
Quis supports accessing object properties using both dot notation and bracket notation:
Access object properties using dot syntax:
$user.name - Access the 'name' property of the user object$user.age - Access the 'age' property of the user objectAccess object properties using bracket syntax:
$user[name] - Access using unquoted key$user["name"] - Access using double-quoted key$user['name'] - Access using single-quoted key$settings["theme-color"] - Access keys with hyphens$settings["auto save"] - Access keys with spacesBoth notations can be used in any comparison operation supported by Quis.
Quis supports complex boolean expressions using both symbolic and word-based operators:
AND Operations (both equivalent):
&& - Symbolic AND operatorAND - Word-based AND operatorOR Operations (both equivalent):
|| - Symbolic OR operatorOR - Word-based OR operatorOperators follow standard precedence rules:
() - Highest precedence>, <, ==, etc.)&&, AND)||, OR) - Lowest precedence// Simple boolean expressions
'$user.age >= 18 && $user.verified == true'
'$health < 20 OR $inventory.potion == true'
// Mixed symbolic and word operators
'$level >= 5 AND ($gold > 100 || $gems >= 10)'
// Complex nested expressions
'($user.role == "admin" || $user.role == "moderator") && $user.active == true'
// Import parse() function (ES Modules)
import { parse } from 'quis';
// Or default import
import quis from 'quis';
const { parse } = quis;
// Create a values function. (This must be a callback returning a value.)
const values = (label) => {
if(label == 'example') {
return 2;
}
if(label == 'user') {
return {
name: 'John',
age: 25,
status: 'active'
};
}
};
// Example contents array.
const content = [
{
condition: "$example > 3",
text: "A"
},
{
condition: "$example == 2",
text: "B"
},
{
condition: '$user.age >= 18',
text: "C"
},
{
condition: '$user["status"] == "active"',
text: "D"
},
{
condition: '$user.age >= 21 && $user.status == "premium"',
text: "E - Premium adult content"
},
{
condition: '$user.health < 20 || $inventory.potion == true',
text: "F - Emergency healing available"
}
];
// filter() the array based on values + parse().
const results = content.filter(
(entry) => parse(entry.condition, { values: values } ) == true
);
// Results include entries B, C, D, and potentially E and F (depending on user data).
console.log(results);
Quis is designed for optimal performance and minimal footprint:
+, -, *, /==, !=, >, <, >=, <=, is, is notand, or, not, &&, ||, !$user.name) and bracket notation ($user["name"])npm install quis
MIT
FAQs
A simple DSL for data sorting and filtering
We found that quis demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.