
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
Tokenizes strings that represent a regular expressions.
const ret = require('ret');
let tokens = ret(/foo|bar/.source);
tokens will contain the following object
{
"type": ret.types.ROOT
"options": [
[ { "type": ret.types.CHAR, "value", 102 },
{ "type": ret.types.CHAR, "value", 111 },
{ "type": ret.types.CHAR, "value", 111 } ],
[ { "type": ret.types.CHAR, "value", 98 },
{ "type": ret.types.CHAR, "value", 97 },
{ "type": ret.types.CHAR, "value", 114 } ]
]
}
The reconstruct function accepts an any token and returns, as a string, the component of the regular expression that is associated with that token.
import { reconstruct, types } from 'ret'
const tokens = ret(/foo|bar/.source)
const setToken = {
"type": types.SET,
"set": [
{ "type": types.CHAR, "value": 97 },
{ "type": types.CHAR, "value": 98 },
{ "type": types.CHAR, "value": 99 }
],
"not": true
}
reconstruct(tokens) // 'foo|bar'
reconstruct({ "type": types.CHAR, "value": 102 }) // 'f'
reconstruct(setToken) // '^abc'
ret.types is a collection of the various token types exported by ret.
Only used in the root of the regexp. This is needed due to the posibility of the root containing a pipe | character. In that case, the token will have an options key that will be an array of arrays of tokens. If not, it will contain a stack key that is an array of tokens.
{
"type": ret.types.ROOT,
"stack": [token1, token2...],
}
{
"type": ret.types.ROOT,
"options" [
[token1, token2...],
[othertoken1, othertoken2...]
...
],
}
Groups contain tokens that are inside of a parenthesis. If the group begins with ? followed by another character, it's a special type of group. A ':' tells the group not to be remembered when exec is used. '=' means the previous token matches only if followed by this group, and '!' means the previous token matches only if NOT followed.
Like root, it can contain an options key instead of stack if there is a pipe.
{
"type": ret.types.GROUP,
"remember" true,
"followedBy": false,
"notFollowedBy": false,
"stack": [token1, token2...],
}
{
"type": ret.types.GROUP,
"remember" true,
"followedBy": false,
"notFollowedBy": false,
"options" [
[token1, token2...],
[othertoken1, othertoken2...]
...
],
}
\b, \B, ^, and $ specify positions in the regexp.
{
"type": ret.types.POSITION,
"value": "^",
}
Contains a key set specifying what tokens are allowed and a key not specifying if the set should be negated. A set can contain other sets, ranges, and characters.
{
"type": ret.types.SET,
"set": [token1, token2...],
"not": false,
}
Used in set tokens to specify a character range. from and to are character codes.
{
"type": ret.types.RANGE,
"from": 97,
"to": 122,
}
{
"type": ret.types.REPETITION,
"min": 0,
"max": Infinity,
"value": token,
}
References a group token. value is 1-9.
{
"type": ret.types.REFERENCE,
"value": 1,
}
Represents a single character token. value is the character code. This might seem a bit cluttering instead of concatenating characters together. But since repetition tokens only repeat the last token and not the last clause like the pipe, it's simpler to do it this way.
{
"type": ret.types.CHAR,
"value": 123,
}
ret.js will throw errors if given a string with an invalid regular expression. All possible errors are
? character is followed by an invalid character. It can only be followed by !, =, or :. Example: /(?_abc)//foo|?bar/, /{1,3}foo|bar/, /foo(+bar)//hello)2u//(1(23)4//[abc/Regular expressions follow the JavaScript syntax.
The following latest JavaScript additions are not supported yet:
\p and \P: Unicode property escapes(?<group>) and \k<group>: Named groups(?<=) and (?<!): Negative lookbehind assertions/abc/
{
"type": ret.types.ROOT,
"stack": [
{ "type": ret.types.CHAR, "value": 97 },
{ "type": ret.types.CHAR, "value": 98 },
{ "type": ret.types.CHAR, "value": 99 }
]
}
/[abc]/
{
"type": ret.types.ROOT,
"stack": [{
"type": ret.types.SET,
"set": [
{ "type": ret.types.CHAR, "value": 97 },
{ "type": ret.types.CHAR, "value": 98 },
{ "type": ret.types.CHAR, "value": 99 }
],
"not": false
}]
}
/[^abc]/
{
"type": ret.types.ROOT,
"stack": [{
"type": ret.types.SET,
"set": [
{ "type": ret.types.CHAR, "value": 97 },
{ "type": ret.types.CHAR, "value": 98 },
{ "type": ret.types.CHAR, "value": 99 }
],
"not": true
}]
}
/[a-z]/
{
"type": ret.types.ROOT,
"stack": [{
"type": ret.types.SET,
"set": [
{ "type": ret.types.RANGE, "from": 97, "to": 122 }
],
"not": false
}]
}
/\w/
// Similar logic for `\W`, `\d`, `\D`, `\s` and `\S`
{
"type": ret.types.ROOT,
"stack": [{
"type": ret.types.SET,
"set": [{
{ "type": ret.types.CHAR, "value": 95 },
{ "type": ret.types.RANGE, "from": 97, "to": 122 },
{ "type": ret.types.RANGE, "from": 65, "to": 90 },
{ "type": ret.types.RANGE, "from": 48, "to": 57 }
}],
"not": false
}]
}
/./
// any character but CR, LF, U+2028 or U+2029
{
"type": ret.types.ROOT,
"stack": [{
"type": ret.types.SET,
"set": [
{ "type": ret.types.CHAR, "value": 10 },
{ "type": ret.types.CHAR, "value": 13 },
{ "type": ret.types.CHAR, "value": 8232 },
{ "type": ret.types.CHAR, "value": 8233 }
],
"not": true
}]
}
/a*/
{
"type": ret.types.ROOT,
"stack": [{
"type": ret.types.REPETITION,
"min": 0,
"max": Infinity,
"value": { "type": ret.types.CHAR, "value": 97 }
}]
}
/a+/
{
"type": ret.types.ROOT,
"stack": [{
"type": ret.types.REPETITION,
"min": 1,
"max": Infinity,
"value": { "type": ret.types.CHAR, "value": 97 },
}]
}
/a?/
{
"type": ret.types.ROOT,
"stack": [{
"type": ret.types.REPETITION,
"min": 0,
"max": 1,
"value": { "type": ret.types.CHAR, "value": 97 }
}]
}
/a{3}/
{
"type": ret.types.ROOT,
"stack": [{
"type": ret.types.REPETITION,
"min": 3,
"max": 3,
"value": { "type": ret.types.CHAR, "value": 97 }
}]
}
/a{3,5}/
{
"type": ret.types.ROOT,
"stack": [{
"type": ret.types.REPETITION,
"min": 3,
"max": 5,
"value": { "type": ret.types.CHAR, "value": 97 }
}]
}
/a{3,}/
{
"type": ret.types.ROOT,
"stack": [{
"type": ret.types.REPETITION,
"min": 3,
"max": Infinity,
"value": { "type": ret.types.CHAR, "value": 97 }
}]
}
/(a)/
{
"type": ret.types.ROOT,
"stack": [{
"type": ret.types.GROUP,
"stack": { "type": ret.types.CHAR, "value": 97 },
"remember": true
}]
}
/(?:a)/
{
"type": ret.types.ROOT,
"stack": [{
"type": ret.types.GROUP,
"stack": { "type": ret.types.CHAR, "value": 97 },
"remember": false
}]
}
/(?=a)/
{
"type": ret.types.ROOT,
"stack": [{
"type": ret.types.GROUP,
"stack": { "type": ret.types.CHAR, "value": 97 },
"remember": false,
"followedBy": true
}]
}
/(?!a)/
{
"type": ret.types.ROOT,
"stack": [{
"type": ret.types.GROUP,
"stack": { "type": ret.types.CHAR, "value": 97 },
"remember": false,
"notFollowedBy": true
}]
}
/a|b/
{
"type": ret.types.ROOT,
"options": [
[{ "type": ret.types.CHAR, "value": 97 }],
[{ "type": ret.types.CHAR, "value": 98 }]
]
}
/(a|b)/
{
"type": ret.types.ROOT,
"stack": [
"type": ret.types.GROUP,
"remember": true,
"options": [
[{ "type": ret.types.CHAR, "value": 97 }],
[{ "type": ret.types.CHAR, "value": 98 }]
]
]
}
/^/
{
"type": ret.types.ROOT,
"stack": [{
"type": ret.types.POSITION,
"value": "^"
}]
}
/$/
{
"type": ret.types.ROOT,
"stack": [{
"type": ret.types.POSITION,
"value": "$"
}]
}
/\b/
{
"type": ret.types.ROOT,
"stack": [{
"type": ret.types.POSITION,
"value": "b"
}]
}
/\B/
{
"type": ret.types.ROOT,
"stack": [{
"type": ret.types.POSITION,
"value": "B"
}]
}
/\1/
{
"type": ret.types.ROOT,
"stack": [{
"type": ret.types.REFERENCE,
"value": 1
}]
}
npm install ret
Tests are written with vows
npm test
To report a security vulnerability, please use the Tidelift security contact. Tidelift will coordinate the fix and disclosure.
regexpp is a regular expression parser with a focus on providing a detailed abstract syntax tree (AST) for regular expressions. It offers similar functionality to ret in terms of parsing regular expressions but goes further by providing a more comprehensive AST, making it suitable for more complex analysis and manipulation tasks.
regexp-tree is a toolkit for working with regular expressions in JavaScript. It includes a parser, a regexp transformer, and a regexp compatibility transpiler. Compared to ret, regexp-tree offers a broader range of features, including the ability to transform and optimize regular expressions, making it a more versatile tool for developers.
FAQs
Tokenizes a string that represents a regular expression.
The npm package ret receives a total of 20,551,297 weekly downloads. As such, ret popularity was classified as popular.
We found that ret demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.