# @nodesecure/sec-literal

> Package created to analyze JavaScript literals

Latest version **1.4.0** (published 2025-11-11) · MIT license · 0 weekly downloads

## Install

```sh
npm install @nodesecure/sec-literal
pnpm add @nodesecure/sec-literal
yarn add @nodesecure/sec-literal
bun add @nodesecure/sec-literal
```

## Health

**Score 55/100 (C)** — status: stable.

Positive: esm support; no vulnerabilities; high maintenance score.

Warnings: low downloads; no types.

## Facts

| | |
|---|---|
| Version | 1.4.0 |
| Published | 2025-11-11 |
| First published | 2021-06-04 |
| Weekly downloads | 0 |
| License | MIT |
| TypeScript types | none |
| Module format | ESM |
| Dependencies | 3 |
| Unpacked size | 24.9 KB |
| Known vulnerabilities | 0 |
| Install scripts | no |
| GitHub stars | 287 |
| Author | GENTILHOMME Thomas |
| Maintainers | kawacrepe, fraxken, tonygo, antoine-coulon, pierred, clemgbld |
| Keywords | security, literal, estree, analysis, scanner |

## Links

- npm: https://www.npmjs.com/package/@nodesecure/sec-literal
- Repository: https://github.com/NodeSecure/js-x-ray
- Homepage: https://github.com/NodeSecure/js-x-ray/tree/master/workspaces/sec-literal#readme
- Issues: https://github.com/NodeSecure/js-x-ray/issues
- npm.io page: https://npm.io/package/@nodesecure/sec-literal

## Dependencies (3)

- [is-svg](https://npm.io/package/is-svg.md) ^6.0.0
- [string-width](https://npm.io/package/string-width.md) ^8.0.0
- [frequency-set](https://npm.io/package/frequency-set.md) ^2.1.0

## Recent versions

- 1.4.0 (latest) — 2025-11-11
- 1.3.0 — 2025-10-23
- 1.2.0 — 2023-01-14
- 1.1.0 — 2022-04-03
- 1.0.1 — 2021-11-28
- 1.0.0 — 2021-06-04

## README

<p align="center">
  <h1 align="center">
    @nodesecure/sec-literal
  </h1>
</p>

<p align="center">
  This package is a security utilities library created to analyze <a href="https://github.com/estree/estree/blob/master/es5.md#literal">ESTree Literal</a> and JavaScript string primitive.
</p>

## Features

- Detect Hexadecimal, Base64, Hexa and Unicode sequences.
- Detect patterns (prefix, suffix) on groups of identifiers.
- Detect suspicious string and return advanced metrics on it (char diversity etc).

## Getting Started

This package is available in the Node Package Repository and can be easily installed with [npm](https://docs.npmjs.com/getting-started/what-is-npm) or [yarn](https://yarnpkg.com).

```bash
$ npm i @nodesecure/sec-literal
# or
$ yarn add @nodesecure/sec-literal
```

## API

## Hex

### isHex(anyValue): boolean
Detect if the given string is an Hexadecimal value

### isSafe(anyValue): boolean
Detect if the given string is a safe Hexadecimal value. The goal of this method is to eliminate false-positive.

```js
Hex.isSafe("1234"); // true
Hex.isSafe("abcdef"); // true
```

## Literal

### isLiteral(anyValue): boolean
### toValue(anyValue): string
### toRaw(anyValue): string
### defaultAnalysis(literalValue)

## Utils

### isSvg(strValue): boolean

### isSvgPath(strValue): boolean
Detect if a given string is a svg path or not.

### stringCharDiversity(str): number
Get the number of unique chars in a given string

### stringSuspicionScore(str): number
Analyze a given string an give it a suspicion score (higher than 1 or 2 mean that the string is highly suspect).

## Patterns

### commonStringPrefix(leftStr, rightStr): string | null
### commonStringSuffix(leftStr, rightStr): string | null
### commonHexadecimalPrefix(identifiersArray: string[])

## License
MIT

---
_Source: https://npm.io/package/@nodesecure/sec-literal · Machine-readable twin of the npm.io package page. Health data is recomputed on every publish._