
Security News
Axios Maintainer Confirms Social Engineering Attack Behind npm Compromise
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.
#Css lexing for the rest of us
Look here sonny, back in my day we didn't have no fancy regular expressions or tools that generated lexers/parsers from grammar definitions.
What we DID have was a can-do attitude, a spring in our step, and first order functions. And we made due, dammit.
This is a (bad) css lexer with some search functionality bolted on the front of it
Lexer.js provides a Lexer constructor. The lexer object inherits from EventEmitter
var Lexer = require('sealegs').Lexer;
//instantiate lexer
var lexy = new Lexer();
// Lexer emits 2 kinds of events:
//'lexerToken' events are emitted when lexer has lexes another token and it's ready.
lexy.on('lexerToken', function (token) {
//do something with your token.
});
// The 'finished' event is emitted when the lexer runs out of string to lex or encounters and error.
// (Unfortunately, no error events yet)
lexy.on('finished', function () {
// All done
});
//To get the lexer rolling, simply call
lexy.begin('.one .two');
Run captain.js on a file to get all tokens in stdout:
./captain.js sample.css
Run captain.js with the search flag like this:
./captain.js sample.css -s ".one .two"
you will get an output of how many times this selector was found in the code (possibly as a subset of another selector)
Ideas for writing a lexer come from this excellent presentation. Ideas for what makes lexing useful outside of a parser/interpreter come from pfff.
FAQs
custom toy lexer for css
We found that sealegs demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.