npmpackage.info

Gathering detailed insights and metrics for esprima

Other packages similar to esprima

espree

10.3.0

An Esprima-compatible JavaScript parser built on Acorn

esprima-fb

15001.1001.0-dev-harmony-fb

Facebook-specific fork of the esprima project

ast-types

0.14.2

Esprima-compatible implementation of the Mozilla JS Parser API

@types/esprima

4.0.6

TypeScript definitions for esprima

Gathering detailed insights and metrics for esprima

esprima

ECMAScript parsing infrastructure for multipurpose analysis

4.0.1

7,065

BSD-2-Clause

TypeScript

29.02 kB

10,830,977,925 3.5

Installations

npm install esprima

Score

98.5

Supply Chain

85.1

Quality

76.1

Maintenance

100

Vulnerability

100

License

Pull Requests

Open

10

Total

781

Closed

667

Merged

104

Issues

Open

135

Total

656

Closed

521

Releases

Unable to fetch releases

Developer

jquery

Developer Guide

BETA

Module System

CommonJS

Min. Node Version

>=4

Typescript Support

No

Node Version

8.11.3

NPM Version

5.6.0 Statistics

7,065 Stars

1,239 Commits

786 Forks

147 Watching

21 Branches

79 Contributors

Updated on 28 Nov 2024

Bundle Size

131.65 kB

Minified

29.02 kB

Minified + Gzipped

Bundlephobia

Languages

TypeScript (70.71%)

JavaScript (29.29%)

Total Downloads

Cumulative downloads

Total Downloads

10,830,977,925

Last day

-7.5%

9,084,271

Compared to previous day

Last week

-0.2%

53,418,472

Compared to previous week

Last month

13.8%

221,500,580

Compared to previous month

Last year

11.6%

2,261,112,215

Compared to previous year

Daily Downloads

Weekly Downloads

Monthly Downloads

Yearly Downloads

Versions

Esprima (esprima.org, BSD license) is a high performance, standard-compliant ECMAScript parser written in ECMAScript (also popularly known as JavaScript). Esprima is created and maintained by Ariya Hidayat, with the help of many contributors.

Features

Full support for ECMAScript 2019 (ECMA-262 10th Edition)
Sensible syntax tree format as standardized by ESTree project
Experimental support for JSX, a syntax extension for React
Optional tracking of syntax node location (index-based and line-column)
Heavily tested (~1600 unit tests with full code coverage)

API

Esprima can be used to perform lexical analysis (tokenization) or syntactic analysis (parsing) of a JavaScript program.

A simple example on Node.js REPL:

1> var esprima = require('esprima');
2> var program = 'const answer = 42';
3
4> esprima.tokenize(program);
5[ { type: 'Keyword', value: 'const' },
6  { type: 'Identifier', value: 'answer' },
7  { type: 'Punctuator', value: '=' },
8  { type: 'Numeric', value: '42' } ]
9  
10> esprima.parseScript(program);
11{ type: 'Program',
12  body:
13   [ { type: 'VariableDeclaration',
14       declarations: [Object],
15       kind: 'const' } ],
16  sourceType: 'script' }

For more information, please read the complete documentation.

No vulnerabilities found.

10

Dangerous-Workflow

Determines if the project's GitHub Action workflows avoid dangerous patterns.

10

License

Determines if the project has defined a license.

10

Binary-Artifacts

Determines if the project has generated executable (binary) artifacts in the source repository.

10

Security-Policy

Determines if the project has published a security policy.

3

Code-Review

Determines if the project requires human code review before pull requests (aka merge requests) are merged.

2

Pinned-Dependencies

Determines if the project has declared and pinned the dependencies of its build process.

Reason

dependency not pinned by hash detected -- score normalized to 2

Details

Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codestyle.yml:11: update your workflow using https://app.stepsecurity.io/secureworkflow/jquery/esprima/codestyle.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codestyle.yml:14: update your workflow using https://app.stepsecurity.io/secureworkflow/jquery/esprima/codestyle.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/downstream.yml:9: update your workflow using https://app.stepsecurity.io/secureworkflow/jquery/esprima/downstream.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/downstream.yml:11: update your workflow using https://app.stepsecurity.io/secureworkflow/jquery/esprima/downstream.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ecma262suite.yml:9: update your workflow using https://app.stepsecurity.io/secureworkflow/jquery/esprima/ecma262suite.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ecma262suite.yml:11: update your workflow using https://app.stepsecurity.io/secureworkflow/jquery/esprima/ecma262suite.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/nightly.yml:14: update your workflow using https://app.stepsecurity.io/secureworkflow/jquery/esprima/nightly.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/nightly.yml:29: update your workflow using https://app.stepsecurity.io/secureworkflow/jquery/esprima/nightly.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/nightly.yml:30: update your workflow using https://app.stepsecurity.io/secureworkflow/jquery/esprima/nightly.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/tests.yml:13: update your workflow using https://app.stepsecurity.io/secureworkflow/jquery/esprima/tests.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/tests.yml:15: update your workflow using https://app.stepsecurity.io/secureworkflow/jquery/esprima/tests.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/tests.yml:29: update your workflow using https://app.stepsecurity.io/secureworkflow/jquery/esprima/tests.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/tests.yml:31: update your workflow using https://app.stepsecurity.io/secureworkflow/jquery/esprima/tests.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/tests.yml:46: update your workflow using https://app.stepsecurity.io/secureworkflow/jquery/esprima/tests.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/tests.yml:48: update your workflow using https://app.stepsecurity.io/secureworkflow/jquery/esprima/tests.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/tests.yml:62: update your workflow using https://app.stepsecurity.io/secureworkflow/jquery/esprima/tests.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/tests.yml:64: update your workflow using https://app.stepsecurity.io/secureworkflow/jquery/esprima/tests.yml/main?enable=pin
Warn: npmCommand not pinned by hash: .github/workflows/tests.yml:69
Info: 0 out of 17 GitHub-owned GitHubAction dependencies pinned
Info: 6 out of 7 npmCommand dependencies pinned

0

Maintained

Determines if the project is "actively maintained".

0

Token-Permissions

Determines if the project's workflows follow the principle of least privilege.

0

CII-Best-Practices

Determines if the project has an OpenSSF (formerly CII) Best Practices Badge.

0

Branch-Protection

Determines if the default and release branches are protected with GitHub's branch protection settings.

0

Fuzzing

Determines if the project uses fuzzing.

0

SAST

Determines if the project uses static code analysis.

0

Vulnerabilities

Determines if the project has open, known unfixed vulnerabilities.

Reason

46 existing vulnerabilities detected

Details

Warn: Project is vulnerable to: GHSA-6chw-6frg-f759
Warn: Project is vulnerable to: GHSA-v88g-cgmw-v5xw
Warn: Project is vulnerable to: GHSA-93q8-gq69-wqmw
Warn: Project is vulnerable to: GHSA-pp7h-53gx-mx7r
Warn: Project is vulnerable to: GHSA-cwfw-4gq5-mrqx
Warn: Project is vulnerable to: GHSA-g95f-p29q-9xw4
Warn: Project is vulnerable to: GHSA-grv7-fg5c-xmjg
Warn: Project is vulnerable to: GHSA-3xgq-45jj-v275
Warn: Project is vulnerable to: GHSA-9vvw-cc9w-f27h
Warn: Project is vulnerable to: GHSA-gxpj-cx7g-858c
Warn: Project is vulnerable to: GHSA-w573-4hg7-7wgq
Warn: Project is vulnerable to: GHSA-h6ch-v84p-w6p9
Warn: Project is vulnerable to: GHSA-ww39-953v-wcq6
Warn: Project is vulnerable to: GHSA-qh2h-chj9-jffq
Warn: Project is vulnerable to: GHSA-765h-qjxv-5f44
Warn: Project is vulnerable to: GHSA-f2jv-r9rf-7988
Warn: Project is vulnerable to: GHSA-jcpv-g9rr-qxrc
Warn: Project is vulnerable to: GHSA-44pw-h2cw-w3vq
Warn: Project is vulnerable to: GHSA-jp4x-w63m-7wgm
Warn: Project is vulnerable to: GHSA-c429-5p7v-vgjp
Warn: Project is vulnerable to: GHSA-qqgx-2p2h-9c37
Warn: Project is vulnerable to: GHSA-9c47-m6qq-7p4h
Warn: Project is vulnerable to: GHSA-6c8f-qphg-qjgp
Warn: Project is vulnerable to: GHSA-76p3-8jx3-jpfq
Warn: Project is vulnerable to: GHSA-p6mc-m468-83gw
Warn: Project is vulnerable to: GHSA-29mw-wpgm-hmr9
Warn: Project is vulnerable to: GHSA-35jh-r3h4-6jhm
Warn: Project is vulnerable to: GHSA-952p-6rrq-rcjv
Warn: Project is vulnerable to: GHSA-wrvr-8mpx-r7pp
Warn: Project is vulnerable to: GHSA-f8q6-p94x-37v3
Warn: Project is vulnerable to: GHSA-vh95-rmgr-6w4m / GHSA-xvch-5gv4-984h
Warn: Project is vulnerable to: GHSA-w9mr-4mfr-499f
Warn: Project is vulnerable to: GHSA-gqgv-6jq5-jjj9
Warn: Project is vulnerable to: GHSA-hrpp-h998-j3pp
Warn: Project is vulnerable to: GHSA-7xfp-9c55-5vqj
Warn: Project is vulnerable to: GHSA-p8p7-x288-28g6
Warn: Project is vulnerable to: GHSA-c2qf-rxjj-qqgw
Warn: Project is vulnerable to: GHSA-3jfq-g458-7qm9
Warn: Project is vulnerable to: GHSA-r628-mhmh-qjhw
Warn: Project is vulnerable to: GHSA-9r2w-394v-53qc
Warn: Project is vulnerable to: GHSA-5955-9wpr-37jh
Warn: Project is vulnerable to: GHSA-qq89-hq3f-393p
Warn: Project is vulnerable to: GHSA-f5x3-32g6-xq36
Warn: Project is vulnerable to: GHSA-72xf-g2v4-qvf3
Warn: Project is vulnerable to: GHSA-xc7v-wxcw-j472
Warn: Project is vulnerable to: GHSA-j8xg-fqg3-53r7

Score

3.5

/10

Last Scanned on 2024-11-18

The Open Source Security Foundation is a cross-industry collaboration to improve the security of open source software (OSS). The Scorecard provides security health metrics for open source projects.

Learn More

Other packages similar to esprima

Other packages similar to esprima

esprima

Installations

Score

Pull Requests

10

781

667

104

Issues

135

656

521

Releases

Unable to fetch releases

Developer

Developer Guide

CommonJS

>=4

No

8.11.3

5.6.0

Statistics

Bundle Size

131.65 kB

29.02 kB

Languages

Total Downloads

10,830,977,925

Daily Downloads

Weekly Downloads

Monthly Downloads

Yearly Downloads

Dev Dependencies

Features

API

10

10

10

10

3

2

0

0

0

0

0

0

0

3.5

/10