[_RPM]

The AST? What AST is that? You don't get access to an AST.

[concise_unicorn]

Tools like acorn[1] and Esprima[2] can parse the JavaScript source and output an ESTree compliant syntax tree.

Then you can traverse it and modify it like any other AST.

[1] https://github.com/ternjs/acorn [2] http://esprima.org/ [3] https://github.com/estree/estree

[throwanem]

The AST you get from any of a wide variety of parsers, of which esprima may still be only the most popular of many.

[Etzos]

It has to open and read a .js file already, it can certainly turn that into the representative AST for said file and then use the data from that. It will be slower, but it will also be more accurate and less likely to turn up false positives or miss things.

[_RPM]

It has to parse a javascript file, which isn't trivial. The reason they use regular expression is because implementing a javascript parser isn't an easy problem to solve fast, even though the grammar is available.

[Etzos]

One certainly does not need to implement a parser, just use one of the many available. As the sibling here pointed out the time it would take to parse and walk the AST is negligible compared to the downloads happening.

[elmigranto]

You downloading megabytes over network and performing disk IO with it. What's the problem with 100 milliseconds of file parsing?