
Research
2025 Report: Destructive Malware in Open Source Packages
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.
Mathematical expressions evaluator that supports math functions and enumerators, using only `System`.
Mathematical expressions evaluator that supports math and enumerable functions, using only System,
from the lexer to the parser with no bizarre regex.
dotnet add package Eval.cs
using System;
using Eval;
// csharp prefixes can be omitted and lower cased
Console.WriteLine(Evaluator.Evaluate("-2 + pi - Ceiling(3.2)"));
// Everything is called like functions
Console.WriteLine(Evaluator.Evaluate("IEnumerable.Average(2, 3, 5)"));
Console.WriteLine(Evaluator.Evaluate("pow(-average(2, 3, 5), -5)"));
Console.WriteLine(Evaluator.Evaluate("19e-11 /- 12");
Console.WriteLine(Evaluator.Evaluate("last(4, last(1, 2), 5)");
Console.WriteLine(Evaluator.Evaluate("921.315 * -20.93 % 34.567");
Console.WriteLine(Evaluator.Evaluate(" 9>>3 /+ 1.2");
There are two custom exceptions, catch the rest as general exceptions that have a message
Means that the passed string is not a valid expression
| Type | Property | Description |
|---|---|---|
string | Src | the expression |
int | Offset | the offset before the error, specialy useful for pointing where the error has happened |
int | Length | the length of the wrong value or function |
string | Message | the cause of the exception, eg: "Closing unexsistent paren" |
Means that the wrong of arguments was passed to a function
| Type | Property | Description |
|---|---|---|
string | Src | same as InvalidExpressionException |
int | Offset | same as InvalidExpressionException |
int | Length | same as InvalidExpressionException |
string | Message | the message: $"Function() expects Expected arguments but received Received" |
string | Function | name of the failed function |
int | Expected | expected amount of arguments |
int | Received | received amount of arguments |
Should not happen unless there is a logical problem with this evaluator
Throw like an general Exception that has a message
A text based exception
pow() expects 2 arguments but received 3
Math.Pow(1, 2, 3) - 4
^~~~~~~~~~~~~~~~^
using Eval;
using System;
static string ErrorMsg(string message, string src, int offset, int length)
{
if (length < 1)
{
return $"{message}";
}
var marker = new string(' ', offset);
if (length == 1)
{
marker += "^";
}
else if (length == 2)
{
marker += "^^";
}
else if (length > 2)
{
marker += $"^{new('~', length - 2)}^";
}
return $"{message}\n{src}\n{marker}";
}
try
{
var result = Evaluator.Evaluate("Math.Pow(1, 2, 3) - 4");
}
catch (Exception e)
{
Console.WriteLine(
e switch
{
InvalidExpressionException ie => ErrorMsg(ie.Message, ie.Src, ie.Offset, ie.Length),
ArgumentAmountException ae => ErrorMsg(ae.Message, ae.Src, ae.Offset, ae.Length),
_ => e.Message
}
);
}
Generates simple math expressions, does not generate functions and parens.
Code to test the lexer, evaluation and exceptions.
FAQs
Mathematical expressions evaluator that supports math functions and enumerators, using only `System`.
We found that eval.cs demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.

Security News
Socket CTO Ahmad Nassri shares practical AI coding techniques, tools, and team workflows, plus what still feels noisy and why shipping remains human-led.

Research
/Security News
A five-month operation turned 27 npm packages into durable hosting for browser-run lures that mimic document-sharing portals and Microsoft sign-in, targeting 25 organizations across manufacturing, industrial automation, plastics, and healthcare for credential theft.