array-map
`[].map(f)` for older browsers
2
Versions
MIT
License
No
Install Scripts
Missing
Provenance
Supply chain provenance
Status for the latest visible version.
No SLSA provenance
npm registry signatures
gitHead linked
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
substackljharbnopersonsmodules
Keywords
arraymapbrowseres5shimie6ie7ie8
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| npm-metadata | suspicious-initial-version | AI (npm-metadata): substack's convention for simple utility packages; this package has been at 0.0.0 for 12+ years with 645k weekly downloads — clearly not a malicious throwaway. | ai | |
| provenance | no-provenance | AI (provenance): Package predates Sigstore provenance by many years; lack of provenance is expected and not a risk signal here. | ai | |
| provenance | publisher-changed | AI (provenance): Legitimate maintainer transition from substack to ljharb, a highly trusted npm publisher with thousands of approved packages. | ai | |
| maintainer-change | maintainer-added | AI (maintainer-change): ljharb and nopersonsmodules added as part of well-known substack-to-ljharb package adoption pattern. | ai | |
| publish-pattern | dormant-publish | AI (publish-pattern): Dormancy reflects substack's inactivity; ljharb revival is a known, legitimate pattern across many packages. | ai |