
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
CLI tool that leverages TypeScript's Abstract Syntax Tree (AST) to perform precise and efficient searches
tsgrep is a library that leverages JavaScript/TypeScript's Abstract Syntax Tree (AST) to perform precise and efficient searches within your codebase. Unlike traditional text-based search tools, tsgrep understands the structure of your code, enabling advanced queries that are both accurate and context-aware.
To install tsgrep:
npm i tsgrep
flowchart LR
subgraph A[API]
S[search.ts]
end
subgraph Q[Query]
QC[queryCache.ts]
GR[grammar.peggy]
UTL[utils.ts]
end
subgraph O[Orchestration]
SM[searchManager.ts]
WP[workerPool.ts]
end
subgraph W[Workers]
W1[scan.worker.ts]
MT[matcher.ts]
end
subgraph L[Libraries]
FG[fast-glob]
IG[ignore]
BAB[Babel Parser]
end
S --> QC
QC --> GR
QC --> UTL
S --> SM
S --> FG
S --> IG
S --> WP
WP --> W1
W1 --> MT
MT --> BAB
sequenceDiagram
participant U as User
participant S as search.ts
participant Q as queryCache
participant M as searchManager
participant P as workerPool
participant W as scan.worker
participant T as matcher
U->>S: search(expression, options)
S->>Q: parseQuery(expression)
Q-->>S: QueryNode
S->>M: startProgressReporting()
S->>S: findFiles()
alt No files found
S-->>U: []
else Files found
S->>P: processBatches(files)
par Each batch
P->>W: postMessage(batch)
W->>T: scanForMatches()
T-->>W: results
W-->>P: batch results
P->>M: onBatchResults()
end
S->>M: flushProgress()
S->>S: dedupeResults()
S-->>U: final results
end
flowchart TD
A[Receive files & query] --> B{Next file?}
B -->|Yes| C[Read file source]
C --> D[Parse with Babel]
D --> E[Traverse AST]
E --> F{Match node?}
F -->|Yes| G[Add to results]
F -->|No| E
E -->|Done| H[Return results]
B -->|No| H
D -->|Error| I[Skip file]
stateDiagram-v2
[*] --> Idle
Idle --> Reporting : start
state Reporting {
[*] --> Waiting
Waiting --> Processing : batch received
Processing --> Waiting : results stored
Waiting --> Flushing : interval reached
Flushing --> Waiting : progress emitted
}
Reporting --> Idle : stop
flowchart LR
A[Files] --> B[Split into batches]
B --> C[Worker 1]
B --> D[Worker 2]
B --> E[Worker N]
C --> F[Results]
D --> F
E --> F
classDiagram
class QueryNode {
+type: String
+children: Array
+value: Any
}
class SearchResult {
+file: String
+line: Number
+content: String
}
class SearchOptions {
+ignore: Array
+gitignore: Boolean
+batchSize: Number
}
QueryNode --> SearchResult
SearchOptions --> SearchResult
import { search } from 'tsgrep';
// use search(<Expression>, <Directory>, <Options>) to get matches
FAQs
CLI tool that leverages TypeScript's Abstract Syntax Tree (AST) to perform precise and efficient searches
The npm package tsgrep receives a total of 29 weekly downloads. As such, tsgrep popularity was classified as not popular.
We found that tsgrep demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.