const regex = /((?<=<[_a-zA-Z][^<]*?))\s+href\s*=\s*["']?\s*javascript:[^"<]*["']?/gm;
// Alternative syntax using RegExp constructor
// const regex = new RegExp('((?<=<[_a-zA-Z][^<]*?))\\s+href\\s*=\\s*["\']?\\s*javascript:[^"<]*["\']?', 'gm')
const str = `<a href="javascript:console.log(document.cookie)"></a>
<a href='javascript:console.log(document.cookie)'></a>
<a href = "javascript:console.log(document.cookie)"></a>
<a href=" javascript:console.log(document.cookie)"></a>
<a href=javascript:console.log(document.cookie)></a>
<a
href=
"javascript:console.log(document.cookie)">
</a>`;
const subst = `$1`;
// The substituted value will be contained in the result variable
const result = str.replace(regex, subst);
console.log('Substitution result: ', result);
Please keep in mind that these code samples are automatically generated and are not guaranteed to work. If you find any syntax errors, feel free to submit a bug report. For a full regex reference for JavaScript, please visit: https://developer.mozilla.org/en/docs/Web/JavaScript/Guide/Regular_Expressions