
Research
TeamPCP-Linked Supply Chain Attack Hits SAP CAP and Cloud MTA npm Packages
Compromised SAP CAP npm packages download and execute unverified binaries, creating urgent supply chain risk for affected developers and CI/CD environments.
grep-ast
Advanced tools
Grep source code files and see matching lines with useful context that show how they fit into the code. See the loops, functions, methods, classes, etc that contain all the matching lines. Get a sense of what's inside a matched class or function definition. You see relevant code from every layer of the abstract syntax tree, above and below the matches.
By default, grep-AST recurses the current directory to search all source code files.
It respects .gitignore, so it will usually "do the right thing" in most repos
if you just do grep-ast <regex> without specifying any filenames.
You can also invoke grep-ast as gast for convenience.
Grep-AST is built with tree-sitter and tree-sitter-languages. So it supports a lot of popular code languages.
python -m pip install git+https://github.com/paul-gauthier/grep-ast.git
Basic usage:
grep-ast [pattern] [filenames...]
Full options list:
usage: grep_ast.py [-h] [-i] [--color] [--no-color] [--encoding ENCODING] [--languages] [--verbose]
[pat] [filenames ...]
positional arguments:
pat the pattern to search for
filenames the files to display
options:
-h, --help show this help message and exit
-i, --ignore-case ignore case distinctions
--color force color printing
--no-color disable color printing
--encoding ENCODING file encoding
--languages print the parsers table
--verbose enable verbose output
Here we search for "encoding" in the source to this tool.
These results mainly highlight how grep-ast
shows you how the matches fit into the code base.
Here we search for "TreeContext" in the source to this tool.
These results mainly highlight how grep-ast
helps you understand the contents of a matching
named code block (class, function, method, etc).
FAQs
A tool to grep through the AST of a source file
We found that grep-ast demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Compromised SAP CAP npm packages download and execute unverified binaries, creating urgent supply chain risk for affected developers and CI/CD environments.

Company News
Socket has acquired Secure Annex to expand extension security across browsers, IDEs, and AI tools.

Research
/Security News
Socket is tracking cloned Open VSX extensions tied to GlassWorm, with several updated from benign-looking sleepers into malware delivery vehicles.