@nodesecure/js-x-ray 8.0.0 → 8.1.0

package/LICENSE

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2021-2024 NodeSecure
+Copyright (c) 2021-2025 NodeSecure
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

package/package.json

@@ -1,11 +1,11 @@
 {
   "name": "@nodesecure/js-x-ray",
-  "version": "8.0.0",
+  "version": "8.1.0",
   "description": "JavaScript AST XRay analysis",
   "type": "module",
   "exports": "./index.js",
   "engines": {
-    "node": ">=18.0.0"
+    "node": ">=20.0.0"
   },
   "scripts": {
     "lint": "eslint src workspaces test",
@@ -49,12 +49,12 @@
     "estree-walker": "^3.0.1",
     "frequency-set": "^1.0.2",
     "is-minified-code": "^2.0.0",
-    "meriyah": "^5.0.0",
+    "meriyah": "^6.0.0",
     "safe-regex": "^2.1.1",
     "ts-pattern": "^5.0.6"
   },
   "devDependencies": {
-    "@openally/config.eslint": "^1.0.0",
+    "@openally/config.eslint": "^2.0.0",
     "@types/node": "^22.0.0",
     "c8": "^10.1.2",
     "glob": "^11.0.0",

package/src/ProbeRunner.js

@@ -11,6 +11,7 @@ import isImportDeclaration from "./probes/isImportDeclaration.js";
 import isWeakCrypto from "./probes/isWeakCrypto.js";
 import isBinaryExpression from "./probes/isBinaryExpression.js";
 import isArrayExpression from "./probes/isArrayExpression.js";
+import isESMExport from "./probes/isESMExport.js";
 
 // Import Internal Dependencies
 import { SourceFile } from "./SourceFile.js";
@@ -39,6 +40,7 @@ export class ProbeRunner {
    */
   static Defaults = [
     isRequire,
+    isESMExport,
     isUnsafeCallee,
     isLiteral,
     isLiteralRegex,

package/src/SourceFile.js

@@ -129,7 +129,7 @@ export class SourceFile {
     this.deobfuscator.walk(node);
 
     // Detect TryStatement and CatchClause to known which dependency is required in a Try {} clause
-    if (node.type === "TryStatement" && typeof node.handler !== "undefined") {
+    if (node.type === "TryStatement" && node.handler) {
       this.inTryStatement = true;
     }
     else if (node.type === "CatchClause") {

package/src/probes/isESMExport.js

@@ -0,0 +1,31 @@
+/**
+ * @description Search for ESM Export
+ *
+ * @example
+ * export { bar } from "./foo.js";
+ * export * from "./bar.js";
+ */
+function validateNode(node) {
+  return [
+    /**
+     * We must be sure that the source property is a Literal to not fall in a trap
+     * export const foo = "bar";
+     */
+    (node.type === "ExportNamedDeclaration" && node.source?.type === "Literal") ||
+    node.type === "ExportAllDeclaration"
+  ];
+}
+
+function main(node, { sourceFile }) {
+  sourceFile.addDependency(
+    node.source.value,
+    node.loc
+  );
+}
+
+export default {
+  name: "isESMExport",
+  validateNode,
+  main,
+  breakOnMatch: true
+};