Research
Security News
Quasar RAT Disguised as an npm Package for Detecting Vulnerabilities in Ethereum Smart Contracts
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
AST visitors for Typescript.
Typescript transpilation is usually source -> AST -> target
.
Tspoon uses Typescript's compiler API
to allow pluggable pieces of logic (called visitor
) to modify the
AST before invoking
the Typescript transpiler. The process will look like this source -> AST -visitors-> AST -> target
.
This technique enables early optimizations and error detection for custom
language features.
In addition, Tspoon's validation api supports pre-validation code changes, allowing the developer to bypass otherwise unavoidable TypeScript diagnostics.
Simple examples can be found here and here.
Install tspoon using npm.
npm install tspoon
Currently, Tspoon exposes only a programmatic API. Meaning, it is used
by other javacript code invoking it's transpile
and validate
methods.
content is a string containing the code to transpile, and config defines the visitors and transpilation parameters. The result is an instance of the TranspilerOutput interface, containing the transpiled code, a source map describing all changes done to the code, the diagnostics generated by the visitors and Typescript, and whether the operation failed or not.
// from src/transpile.ts
interface TranspilerOutput {
code: string,
sourceMap: RawSourceMap,
diags: ts.Diagnostic[],
halted: boolean
}
var tspoon = require('tspoon');
// from examples/poc/build.js
var config = {
sourceFileName: 'src.ts',
visitors: ... // insert visitors here
};
var sourceCode = fs.readFileSync(...);
var transpilerOut = tspoon.transpile(sourceCode, config);
...
fs.writeFileSync(path.join(__dirname, 'src.js'), transpilerOut.code, {encoding:'utf8'});
Documentation pending writing
A visitor is an instance of the visitor interface:
// from src/visitor.ts
interface Visitor {
filter(node: ts.Node) : boolean;
visit(node: ts.Node, context: VisitorContext, traverse: (...visitors: Visitor[]) => void): void;
}
Consider for example the following visitor:
// from examples/poc/deletePrivate.js
{
filter(node){
return node.kind === ts.SyntaxKind.PropertyDeclaration
&& node.modifiers
&& node.modifiers.some(function(m){
return m.kind === ts.SyntaxKind.PrivateKeyword;
});
},
visit(node, context, traverse) {
context.replace(node.getStart(), node.getEnd(), '');
context.reportDiag(node, ts.DiagnosticCategory.Message, 'deleted field "' + node.getText()+'"', false);
}
}
This visitor only operates on nodes representing property declarations
which have the private
modifier. When such a node is encountered,
it is deleted from the source code, and a diagnostic message notifying
the delete action is emitted.
The code transformations often happens on multiple levels of the AST. For example, one needs to traverse all class declarations, but the actual transformation is performed on the respective syntax subtree (e.g. method bodies). In order to achieve this, TSpoon lets you to execute a visitor from another visitor:
var visitor = {
filter(node) {
return node.kind === ts.SyntaxKind.ClassDeclaration;
},
visit(node, context, traverse) {
traverse([{
filter(node) {
return node.kind === ts.SyntaxKind.Block;
},
visit(node, context, travers) {
context.replace(node.getStart(), node.getEnd(), '');
}
}]);
}
}
(This example will remove execution blocks within classes.)
Clone this project locally. Then, at the root folder of the project, run:
npm install
npm test
At the root folder of the project, run:
npm start
Then, open your browser at http://localhost:8080/webtest.bundle and see any changes you make in tests or code reflected in the browser
Currently Tspoon is in alpha mode. As such, it does not respect semver.
We use a custom license, see LICENSE.md
FAQs
AST visitors for TypeScript
We found that tspoon demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 10 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
Security News
Research
A supply chain attack on Rspack's npm packages injected cryptomining malware, potentially impacting thousands of developers.
Research
Security News
Socket researchers discovered a malware campaign on npm delivering the Skuld infostealer via typosquatted packages, exposing sensitive data.