Gathering detailed insights and metrics for acorn
Gathering detailed insights and metrics for acorn
Gathering detailed insights and metrics for acorn
Gathering detailed insights and metrics for acorn
A small, fast, JavaScript-based JavaScript parser
npm install acorn
Module System
Min. Node Version
Typescript Support
Node Version
NPM Version
10,631 Stars
1,474 Commits
886 Forks
176 Watching
8 Branches
120 Contributors
Updated on 28 Nov 2024
Minified
Minified + Gzipped
JavaScript (99.89%)
HTML (0.11%)
Cumulative downloads
Total Downloads
Last day
-1.2%
22,251,816
Compared to previous day
Last week
4.1%
122,479,408
Compared to previous week
Last month
5%
477,571,770
Compared to previous month
Last year
6.8%
4,724,818,695
Compared to previous year
No dependencies detected.
A tiny, fast JavaScript parser, written completely in JavaScript.
Acorn is open source software released under an MIT license.
You are welcome to report bugs or create pull requests on github.
This repository holds three packages:
To build the content of the repository, run npm install
.
1git clone https://github.com/acornjs/acorn.git 2cd acorn 3npm install
Acorn is designed to support plugins which can, within reasonable bounds, redefine the way the parser works. Plugins can add new token types and new tokenizer contexts (if necessary), and extend methods in the parser object. This is not a clean, elegant API—using it requires an understanding of Acorn's internals, and plugins are likely to break whenever those internals are significantly changed. But still, it is possible, in this way, to create parsers for JavaScript dialects without forking all of Acorn. And in principle it is even possible to combine such plugins, so that if you have, for example, a plugin for parsing types and a plugin for parsing JSX-style XML literals, you could load them both and parse code with both JSX tags and types.
A plugin is a function from a parser class to an extended parser
class. Plugins can be used by simply applying them to the Parser
class (or a version of that already extended by another plugin). But
because that gets a little awkward, syntactically, when you are using
multiple plugins, the static method Parser.extend
can be called with
any number of plugin values as arguments to create a Parser
class
extended by all those plugins. You'll usually want to create such an
extended class only once, and then repeatedly call parse
on it, to
avoid needlessly confusing the JavaScript engine's optimizer.
1const {Parser} = require("acorn") 2 3const MyParser = Parser.extend( 4 require("acorn-jsx")(), 5 require("acorn-bigint") 6) 7console.log(MyParser.parse("// Some bigint + JSX code"))
Plugins override methods in their new parser class to implement additional functionality. It is recommended for a plugin package to export its plugin function as its default value or, if it takes configuration parameters, to export a constructor function that creates the plugin function.
This is what a trivial plugin, which adds a bit of code to the
readToken
method, might look like:
1module.exports = function noisyReadToken(Parser) { 2 return class extends Parser { 3 readToken(code) { 4 console.log("Reading a token!") 5 super.readToken(code) 6 } 7 } 8}
The latest stable version of the package.
Stable Version
3
7.5/10
Summary
Regular Expression Denial of Service in Acorn
Affected Versions
>= 5.5.0, < 5.7.4
Patched Versions
5.7.4
7.5/10
Summary
Regular Expression Denial of Service in Acorn
Affected Versions
>= 7.0.0, < 7.1.1
Patched Versions
7.1.1
7.5/10
Summary
Regular Expression Denial of Service in Acorn
Affected Versions
>= 6.0.0, < 6.4.1
Patched Versions
6.4.1
3
0/10
Summary
Withdrawn: ESLint dependencies are vulnerable (ReDoS and Prototype Pollution)
Affected Versions
>= 7.0.0, < 7.1.1
Patched Versions
7.1.1
0/10
Summary
Withdrawn: ESLint dependencies are vulnerable (ReDoS and Prototype Pollution)
Affected Versions
>= 6.0.0, < 6.4.1
Patched Versions
6.4.1
0/10
Summary
Withdrawn: ESLint dependencies are vulnerable (ReDoS and Prototype Pollution)
Affected Versions
< 5.7.4
Patched Versions
5.7.4
Reason
11 commit(s) and 8 issue activity found in the last 90 days -- score normalized to 10
Reason
GitHub workflow tokens follow principle of least privilege
Details
Reason
no dangerous workflow patterns detected
Reason
no binaries found in the repo
Reason
0 existing vulnerabilities detected
Reason
Found 11/26 approved changesets -- score normalized to 4
Reason
no effort to earn an OpenSSF best practices badge detected
Reason
security policy file not detected
Details
Reason
license file not detected
Details
Reason
dependency not pinned by hash detected -- score normalized to 0
Details
Reason
branch protection not enabled on development/release branches
Details
Reason
project is not fuzzed
Details
Reason
SAST tool is not run on all commits -- score normalized to 0
Details
Score
Last Scanned on 2024-11-25
The Open Source Security Foundation is a cross-industry collaboration to improve the security of open source software (OSS). The Scorecard provides security health metrics for open source projects.
Learn More