ast-types
Esprima-compatible implementation of the Mozilla JS Parser API
This package has a good security score with no known vulnerabilities.
Community Reviews
Powerful AST toolkit hampered by poor TypeScript support and steep learning curve
The TypeScript definitions exist but are frustratingly incomplete. Autocomplete works for basic node types, but breaks down with complex traversals or when using `.check()` methods. You'll find yourself constantly referencing the Mozilla Parser API docs or the source code to understand what properties are available. Error messages when validation fails are cryptic—you get "invalid value" without clear indication of what's wrong or what the expected shape should be.
The documentation assumes deep familiarity with AST concepts and doesn't provide enough practical examples. The getting-started experience involves significant trial and error. For teams already invested in the recast/jscodeshift ecosystem, it's tolerable. For new projects, consider @babel/types which offers superior TypeScript support and clearer APIs.
Best for: Projects already using recast or jscodeshift that need AST manipulation with runtime validation.
Avoid if: You're starting a new codebase transformation project and need modern TypeScript support—use @babel/types instead.
Solid AST manipulation library with validation, but maintenance concerns
The library doesn't handle input validation in the security sense—it assumes you're working with parsed ASTs from trusted sources. There's no inherent protection against malicious input trees that could cause resource exhaustion through deeply nested structures. Error messages are descriptive for development but don't expose sensitive information, which is good. However, the lack of updates since 2020 is concerning for long-term maintenance, though the problem space is relatively stable.
For code transformation work, the type checking catches errors early that would otherwise manifest as subtle bugs in generated code. The API is verbose but predictable, making it easier to reason about code correctness in large codebases.
Best for: Building code transformation tools, codemods, and linters where AST correctness and type safety are critical.
Avoid if: You need to process ASTs from untrusted sources or require active maintenance and security updates.
Solid AST manipulation library with good type safety, minimal runtime overhead
The practical experience is mostly positive: visitor pattern support is clean, type definitions are comprehensive, and the namedTypes namespace makes type checking straightforward. Error messages when building malformed nodes are helpful enough to fix issues quickly. Performance is not a concern - validation overhead is negligible compared to parsing or transformation work.
The main friction point is the last release being from 2020, though the API surface is stable enough that this hasn't caused breaking issues. Documentation assumes you already understand AST structures - there's no hand-holding. No logging hooks or observability built in, but for a library operating on data structures, that's actually appropriate. It does one thing well without bloat.
Best for: Building codemods, AST transformations, or static analysis tools where type-safe node construction and validation are critical.
Avoid if: You need active maintenance for cutting-edge JavaScript syntax support or want batteries-included tooling with extensive examples.
Sign in to write a review
Sign In