// npm package

ast-plugin

The simplest abstract syntax tree walker.

npmjs.com tarball repo homepage

versions

maintainers

license

MIT

first publish

2018-11-12

publisher

atool

tarball

7,716 B

AUTO-PUBLISHED·1 version indexed·latest published 2018-12-30

// publisher campaignby atool

9 caught packages from this account

This is not an isolated catch. The same publisher has shipped 8 other packages that our pipeline flagged — the shape of a coordinated campaign, not a one-off. Each link below opens that sibling's analysis.

// offending code· @0.0.7· 1 file flagged

llm: benign · 0.85

→ No suspicious destination, no remote-exec shape — 1 known-vendor host(s).

@0.0.7·2018-12-30·AUTO-PUBLISHED·publisher: atool

heuristic 75/100

static flags 1

llm benign (0.85) via ollama

publisher-multi-name-burst:5osv-flagged:MAL-2026-4128public-github-push

→ No suspicious destination, no remote-exec shape — 1 known-vendor host(s).

// offending code· 1 file flaggedpatterns: 1

--- package/package.json (excerpt) ---
{
  "name": "ast-plugin",
  "version": "0.0.7",
  "description": "The simplest abstract syntax tree walker.",
  "main": "lib/index.js",
  "scripts": {
    "test": "jest --no-cache",
    "coveralls": "cat ./coverage/lcov.info | coveralls",
    "build": "rimraf ./lib && babel src -d lib"
  },
  "repository": {
    "type": "git",
    "url": "git+https://github.com/hustcc/ast-plugin.git"
  },
  "keywords": [
    "ast",
    "plugin",
    "ast-plugin"
  ],
  "author": "hustcc",
  "license": "MIT",
  "bugs": {
    "url": "https://github.com/hustcc/ast-plugin/issues"
  },
  "homepage": "https://github.com/hustcc/ast-plugin#readme",
  "devDependencies": {
    "@babel/cli": "^7.1.5",
    "@babel/core": "^7.1.5",
    "@babel/plugin-proposal-class-properties": "^7.1.0",
    "@babel/plugin-transform-spread": "^7.0.0",
    "@babel/preset-env": "^7.1.5",
    "babel-core": "^7.0.0-bridge.0",
    "babel-jest": "^23.6.0",
    "babel-plugin-version": "^0.2.3",
    "coveralls": "^3.0.2",
    "jest": "^23.6.0",
    "remark-parse": "^6.0.2",
    "rimraf": "^2.6.2",
    "unified": "^7.0.1"
  },
  "jest": {
    "collectCoverage": true,
    "testEnvironment": "node",
    "testRegex": "(/__tests__/.*\\.(test|spec))\\.jsx?$",
    "collectCoverageFrom": [
      "src/**/*.{js,jsx}"
    ]
  }
}


--- package.json (entry) ---
{
  "name": "ast-plugin",
  "version": "0.0.7",
  "description": "The simplest abstract syntax tree walker.",
  "main": "lib/index.js",
  "scripts": {
    "test": "jest --no-cache",
    "coveralls": "cat ./coverage/lcov.info | coveralls",
    "build": "rimraf ./lib && babel src -d lib"
  },
  "repository": {
    "type": "git",
    "url": "git+https://github.com/hustcc/ast-plugin.git"
  },
  "keywords": [
    "ast",
    "plugin",
    "ast-plugin"
  ],
  "author": "hustcc",
  "license": "MIT",
  "bugs": {
    "url": "https://github.com/hustcc/ast-plugin/issues"
  },
  "homepage": "https://github.com/hustcc/ast-plugin#readme",
  "devDependencies": {
    "@babel/cli": "^7.1.5",
    "@babel/core": "^7.1.5",
    "@babel/plugin-proposal-class-properties": "^7.1.0",
    "@babel/plugin-transform-spread": "^7.0.0",
    "@babel/preset-env": "^7.1.5",
    "babel-core": "^7.0.0-bridge.0",
    "babel-jest": "^23.6.0",
    "babel-plugin-version": "^0.2.3",
    "coveralls": "^3.0.2",
    "jest": "^23.6.0",
    "remark-parse": "^6.0.2",
    "rimraf": "^2.6.2",
    "unified": "^7.0.1"
  },
  "jest": {
    "collectCoverage": true,
    "testEnvironment": "node",
    "testRegex": "(/__tests__/.*\\.(tes

--- index.js (entry) ---
"use strict";

Object.defineProperty(exports, "__esModule", {
  value: true
});
Object.defineProperty(exports, "Ast", {
  enumerable: true,
  get: function get() {
    return _Ast.Ast;
  }
});
Object.defineProperty(exports, "Plugin", {
  enumerable: true,
  get: function get() {
    return _Plugin.Plugin;
  }
});
Object.defineProperty(exports, "setGlobalConfig", {
  enumerable: true,
  get: function get() {
    return _global.setGlobalConfig;
  }
});
exports.version = void 0;

var _Ast = require("./Ast");

var _Plugin = require("./Plugin");

var _global = require("./global");

var version = "0.0.7";
exports.version = version;