
Research
2025 Report: Destructive Malware in Open Source Packages
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.
asttokens
Advanced tools
.. image:: https://img.shields.io/pypi/v/asttokens.svg :target: https://pypi.python.org/pypi/asttokens/ .. image:: https://img.shields.io/pypi/pyversions/asttokens.svg :target: https://pypi.python.org/pypi/asttokens/ .. image:: https://github.com/gristlabs/asttokens/actions/workflows/build-and-test.yml/badge.svg :target: https://github.com/gristlabs/asttokens/actions/workflows/build-and-test.yml .. image:: https://readthedocs.org/projects/asttokens/badge/?version=latest :target: https://asttokens.readthedocs.io/en/latest/index.html .. image:: https://coveralls.io/repos/github/gristlabs/asttokens/badge.svg :target: https://coveralls.io/github/gristlabs/asttokens
.. Start of user-guide
The asttokens module annotates Python abstract syntax trees (ASTs) with the positions of tokens
and text in the source code that generated them.
It makes it possible for tools that work with logical AST nodes to find the particular text that resulted in those nodes, for example for automated refactoring or highlighting.
asttokens is available on PyPI: https://pypi.python.org/pypi/asttokens/::
pip install asttokens
The code is on GitHub: https://github.com/gristlabs/asttokens.
The API Reference is here: https://asttokens.readthedocs.io/en/latest/api-index.html.
ASTTokens can annotate both trees built by ast <https://docs.python.org/2/library/ast.html>,
AND those built by astroid <https://github.com/PyCQA/astroid>.
Here's an example:
.. code-block:: python
import asttokens, ast
source = "Robot('blue').walk(steps=10*n)"
atok = asttokens.ASTTokens(source, parse=True)
Once the tree has been marked, nodes get .first_token, .last_token attributes, and
the ASTTokens object offers helpful methods:
.. code-block:: python
attr_node = next(n for n in ast.walk(atok.tree) if isinstance(n, ast.Attribute))
print(atok.get_text(attr_node))
start, end = attr_node.last_token.startpos, attr_node.last_token.endpos
print(atok.text[:start] + 'RUN' + atok.text[end:])
Which produces this output:
.. code-block:: text
Robot('blue').walk
Robot('blue').RUN(steps=10*n)
The ASTTokens object also offers methods to walk and search the list of tokens that make up
the code (or a particular AST node), which is more useful and powerful than dealing with the text
directly.
To contribute:
Fork this repository, and clone your fork.
Install the package with test dependencies (ideally in a virtualenv) with::
pip install -e '.[test]'
Run tests in your current interpreter with the command pytest or python -m pytest.
Run tests across all supported interpreters with the tox command. You will need to have the interpreters installed separately. We recommend pyenv for that. Use tox -p auto to run the tests in parallel.
By default certain tests which take a very long time to run are skipped, but they are run in CI.
These are marked using the pytest marker slow and can be run on their own with pytest -m slow or as part of the full suite with pytest -m ''.
FAQs
Annotate AST trees with source code positions
We found that asttokens demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.

Security News
Socket CTO Ahmad Nassri shares practical AI coding techniques, tools, and team workflows, plus what still feels noisy and why shipping remains human-led.

Research
/Security News
A five-month operation turned 27 npm packages into durable hosting for browser-run lures that mimic document-sharing portals and Microsoft sign-in, targeting 25 organizations across manufacturing, industrial automation, plastics, and healthcare for credential theft.