@babel/parser
A JavaScript parser
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | obfuscated-file:lib/index.d.ts | AI (source-diff): lib/index.d.ts is a legitimate TypeScript declaration file for @babel/parser's public API. Long lines are caused by large union types, not obfuscation. Stable false positive for this package. | ai | |
| maintainer-change | maintainer-added | AI (maintainer-change): developit (Jason Miller) is a reputable, well-known JS ecosystem contributor; addition to Babel org is a legitimate collaboration, not a takeover signal. | ai | |
| provenance | missing-githead | AI (provenance): Missing gitHead is a known artifact of monorepo publish tooling changes in the Babel project; not indicative of tampering for this well-established package. | ai | |
| maintainer-change | maintainer-removed | AI (maintainer-change): Babel team membership has evolved over time; removal of loganfsmyth and danez reflects known team changes, not a takeover. nicolo-ribaudo is a core Babel maintainer. | ai | |
| source-diff | obfuscated-file:lib/util/identifier.js | AI (source-diff): Long lines in identifier.js are Unicode character range tables, a standard pattern in JavaScript parsers. The file is readable, clean code — not obfuscated. | ai | |
| bogus-package | bogus-package | AI (bogus-package): hzoo and loganfsmyth are long-standing Babel core contributors; spam flag is a false positive for this package. | ai | |
| source-diff | large-new-source-files | AI (source-diff): New files are source maps and parser/plugin JS files consistent with a major version bump (7.18.11→7.22.5). Expected growth for a JavaScript parser adding new language features. | ai | |
| publish-pattern | new-deps-added | AI (publish-pattern): @babel/types is a core Babel package added only for type definitions (explicitly documented in package.json). Not a functional runtime dependency and not an attack vector. | ai | |
| provenance | publisher-changed | AI (provenance): Babel project transitioned to GitHub Actions CI/CD publishing — a security improvement over individual account publishing. Consistent with official babel/babel monorepo governance. | ai | |
| provenance | no-provenance | AI (provenance): Babel publishes via GitHub Actions CI without Sigstore attestation; this is consistent across all @babel/* packages and is not a risk indicator. | ai | |
| typosquat | typosquat.levenshtein:parcel | AI (typosquat): @babel/parser is the official Babel JS parser under the @babel scope — a completely distinct, well-established package from 'parcel'. Levenshtein match is a stable false positive for this package. | ai |
Versions (showing 51 of 199)
| Version | Deps | Published |
|---|---|---|
| 7.29.3 | 1 / 6 | |
| 7.29.2 | 1 / 6 | |
| 7.29.0 | 1 / 6 | |
| 7.28.6 | 1 / 6 | |
| 7.28.5 | 1 / 6 | |
| 7.28.4 | 1 / 6 | |
| 7.28.3 | 1 / 6 | |
| 7.28.0 | 1 / 6 | |
| 7.27.7 | 1 / 6 | |
| 7.27.5 | 1 / 6 | |
| 7.27.4 | 1 / 6 | |
| 7.27.3 | 1 / 6 | |
| 7.27.2 | 1 / 6 | |
| 7.27.1 | 1 / 6 | |
| 7.27.0 | 1 / 6 | |
| 7.26.10 | 1 / 6 | |
| 7.26.9 | 1 / 6 | |
| 7.26.8 | 1 / 6 | |
| 7.26.7 | 1 / 6 | |
| 7.26.5 | 1 / 6 | |
| 7.26.3 | 1 / 6 | |
| 7.26.2 | 1 / 6 | |
| 7.26.1 | 1 / 6 | |
| 7.26.0 | 1 / 6 | |
| 7.25.9 | 1 / 6 | |
| 7.25.8 | 1 / 6 | |
| 7.25.7 | 1 / 6 | |
| 7.25.6 | 1 / 6 | |
| 7.25.4 | 1 / 6 | |
| 7.25.3 | 1 / 6 | |
| 7.25.0 | 0 / 7 | |
| 7.24.8 | 0 / 7 | |
| 7.24.7 | 0 / 7 | |
| 7.24.6 | 0 / 7 | |
| 7.24.5 | 0 / 6 | |
| 7.24.4 | 0 / 6 | |
| 7.24.1 | 0 / 6 | |
| 7.24.0 | 0 / 6 | |
| 7.23.9 | 0 / 6 | |
| 7.23.6 | 0 / 6 | |
| 7.23.5 | 0 / 6 | |
| 7.23.4 | 0 / 6 | |
| 7.23.3 | 0 / 6 | |
| 7.23.0 | 0 / 6 | |
| 7.22.16 | 0 / 6 | |
| 7.22.15 | 0 / 6 | |
| 7.22.14 | 0 / 6 | |
| 7.22.13 | 0 / 6 | |
| 7.22.11 | 0 / 6 | |
| 7.22.10 | 0 / 6 | |
| 7.22.7 | 0 / 6 |
v7.29.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v7.29.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v7.29.0
2 findingsThis version was published by a different npm account than previous versions on 2026-01-31. This could indicate a legitimate maintainer transition or an account compromise.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v7.28.6
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v7.28.5
2 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2025-10-23. This could indicate a legitimate maintainer transition or an account compromise.
v7.28.4
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v7.28.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v7.28.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v7.27.7
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v7.27.5
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v7.27.4
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v7.27.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v7.27.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v7.27.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v7.27.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v7.26.10
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v7.26.9
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v7.26.8
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v7.26.7
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v7.26.5
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v7.26.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v7.26.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v7.26.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v7.26.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v7.25.9
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v7.25.8
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v7.25.7
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v7.25.6
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v7.25.4
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v7.25.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v7.25.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v7.24.8
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v7.24.7
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v7.24.6
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v7.24.5
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v7.24.4
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: nicolo-ribaudo.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v7.24.1
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: nicolo-ribaudo.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v7.24.0
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: nicolo-ribaudo.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v7.23.9
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: nicolo-ribaudo.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v7.23.6
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: nicolo-ribaudo.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v7.23.5
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: nicolo-ribaudo.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v7.23.4
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: nicolo-ribaudo.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v7.23.3
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: nicolo-ribaudo.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v7.23.0
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: nicolo-ribaudo.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v7.22.16
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: nicolo-ribaudo.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v7.22.15
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: nicolo-ribaudo.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v7.22.14
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: nicolo-ribaudo.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v7.22.13
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: nicolo-ribaudo.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v7.22.11
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: nicolo-ribaudo.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v7.22.10
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: nicolo-ribaudo.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v7.22.7
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: nicolo-ribaudo.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.