
Research
NPM targeted by malware campaign mimicking familiar library names
Socket uncovered npm malware campaign mimicking popular Node.js libraries and packages from other ecosystems; packages steal data and execute remote code.
Grep source code files and see matching lines with useful context that show how they fit into the code. See the loops, functions, methods, classes, etc that contain all the matching lines. Get a sense of what's inside a matched class or function definition. You see relevant code from every layer of the abstract syntax tree, above and below the matches.
By default, grep-AST recurses the current directory to search all source code files.
It respects .gitignore
, so it will usually "do the right thing" in most repos
if you just do grep-ast <regex>
without specifying any filenames.
You can also invoke grep-ast
as gast
for convenience.
Grep-AST is built with tree-sitter and tree-sitter-languages. So it supports a lot of popular code languages.
python -m pip install git+https://github.com/paul-gauthier/grep-ast.git
Basic usage:
grep-ast [pattern] [filenames...]
Full options list:
usage: grep_ast.py [-h] [-i] [--color] [--no-color] [--encoding ENCODING] [--languages] [--verbose]
[pat] [filenames ...]
positional arguments:
pat the pattern to search for
filenames the files to display
options:
-h, --help show this help message and exit
-i, --ignore-case ignore case distinctions
--color force color printing
--no-color disable color printing
--encoding ENCODING file encoding
--languages print the parsers table
--verbose enable verbose output
Here we search for "encoding" in the source to this tool.
These results mainly highlight how grep-ast
shows you how the matches fit into the code base.
Here we search for "TreeContext" in the source to this tool.
These results mainly highlight how grep-ast
helps you understand the contents of a matching
named code block (class, function, method, etc).
FAQs
A tool to grep through the AST of a source file
We found that grep-ast demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Socket uncovered npm malware campaign mimicking popular Node.js libraries and packages from other ecosystems; packages steal data and execute remote code.
Research
Socket's research uncovers three dangerous Go modules that contain obfuscated disk-wiping malware, threatening complete data loss.
Research
Socket uncovers malicious packages on PyPI using Gmail's SMTP protocol for command and control (C2) to exfiltrate data and execute commands.