
Research
SANDWORM_MODE: Shai-Hulud-Style npm Worm Hijacks CI Workflows and Poisons AI Toolchains
An emerging npm supply chain attack that infects repos, steals CI secrets, and targets developer AI toolchains for further compromise.
scoped is a command line tool to help you reason about your javascript.
scoped is also a library that will give you all of the scope information about
a given falafel-generated AST! (it even works with let!)
var scoped = require('scoped')
, falafel = require('falafel')
falafel('<some javascript>', scoped(function(scope) {
scope.vars // vars declared in this scope
scope.vars[0].name // the name of the var
scope.vars[0].nodes // a list of nodes + kinds of use
scope.vars[0].nodes[0].kind // "implicit", "explicit", or "declare"
scope.vars[0].nodes[0].node // the esprima AST node.
scope.children // the list of child scopes of this node
scope.children[0] // as an array.
scope.uses // the list of variables that this scope
// "uses" from parent scopes. at top level,
// these are globals.
}))
// you can also tell scoped to ignore certain globals:
falafel('<some javascript>', scoped(['Math', 'module'], function(scope) {
}))
it notifies you of globals -- both explicit (created by assigning) and implicit (use without definition) -- and, when given a position in the file, will let you know what variables are in scope at that point.

outputs only global usage/leakage information, with line and column numbers.
outputs scope chain, with usage/definition for each scope. position is
in the form LINE,COLUMN. ,COLUMN may be omitted, if so, it is assumed
to be 1. Both line and column are assumed to be 1-indexed (like most
editors).
Green + signs indicate scope definitions -- i.e., a new variable was created
in this scope.
Purple * signs indicate use of a variable from a containing scope.
If the function is named, it will use that to describe the function.
npm install -g scoped
MIT
FAQs
command line tool exposing lexical-scope
The npm package scoped receives a total of 24 weekly downloads. As such, scoped popularity was classified as not popular.
We found that scoped demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
An emerging npm supply chain attack that infects repos, steals CI secrets, and targets developer AI toolchains for further compromise.

Company News
Socket is proud to join the OpenJS Foundation as a Silver Member, deepening our commitment to the long-term health and security of the JavaScript ecosystem.

Security News
npm now links to Socket's security analysis on every package page. Here's what you'll find when you click through.