eslint-scope
ECMAScript scope analyzer for ESLint
28
Versions
BSD-2-Clause
License
No
Install Scripts
Verified
Provenance
Supply chain provenance
Status for the latest visible version.
SLSA provenance attestation
npm registry signatures
gitHead linked
Maintainers
openjsfoundationeslintbot
Keywords
eslint
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| phantom-deps | phantom-dep:@types/esrecurse | AI (phantom-deps): @types/esrecurse is used for TypeScript type declarations, not direct runtime imports. Expected pattern for TypeScript-enabled packages. | ai | |
| publish-pattern | dormant-publish | AI (publish-pattern): Long gap explained by major version restructuring into eslint/js monorepo; v9.x aligns with ESLint v9 release cycle. | ai | |
| phantom-deps | phantom-dep:@types/estree | AI (phantom-deps): @types/estree is used for TypeScript type declarations, not direct runtime imports. Expected pattern for TypeScript-enabled packages. | ai | |
| provenance | publisher-changed | AI (provenance): ESLint project uses GitHub Actions for automated publishing with SLSA provenance; publisher change from eslintbot to GitHub Actions is expected for this package. | ai | |
| source-diff | net-exec-file:dist/eslint-scope.cjs | AI (source-diff): The CJS bundle is a standard rollup-built distribution of scope analysis code. Sample shows legitimate ESLint scope analyzer logic, not malware. False positive for bundled dist files. | ai | |
| maintainer-change | maintainer-added | AI (maintainer-change): OpenJS Foundation taking over maintainership is consistent with ESLint's governance structure as an OpenJS Foundation project. | ai | |
| maintainer-change | maintainer-removed | AI (maintainer-change): Removal of individual maintainers in favor of OpenJS Foundation org account is consistent with ESLint's governance transition. | ai | |
| provenance | no-provenance | AI (provenance): eslint-scope predates Sigstore provenance adoption; absence is expected for this package's age and does not indicate risk. | ai | |
| dependencies | unvetted-dep:esrecurse | AI (dependencies): esrecurse is a well-known ESTree traversal utility and a legitimate, expected dependency for eslint-scope across all versions. | ai |
Versions (showing 28 of 28)
| Version | Deps | Published |
|---|---|---|
| 9.1.2 | 4 / 7 | |
| 9.1.1 | 4 / 7 | |
| 9.1.0 | 4 / 10 | |
| 9.0.0 | 2 / 8 | |
| 8.4.0 | 2 / 9 | |
| 8.3.0 | 2 / 11 | |
| 8.2.0 | 2 / 11 | |
| 8.1.0 | 2 / 11 | |
| 8.0.2 | 2 / 15 | |
| 8.0.1 | 2 / 15 | |
| 8.0.0 | 2 / 15 | |
| 7.2.2 | 2 / 15 | |
| 7.2.1 | 2 / 15 | |
| 7.2.0 | 2 / 15 | |
| 7.1.1 | 2 / 15 | |
| 7.1.0 | 2 / 15 | |
| 7.0.0 | 2 / 15 | |
| 6.0.0 | 2 / 15 | |
| 5.1.1 | 2 / 13 | |
| 5.1.0 | 2 / 13 | |
| 5.0.0 | 2 / 12 | |
| 4.0.3 | 2 / 11 | |
| 4.0.2 | 2 / 11 | |
| 4.0.1 | 2 / 11 | |
| 4.0.0 | 2 / 11 | |
| 3.7.3 | 2 / 11 | |
| 3.7.1 | 2 / 11 | |
| 3.7.0 | 2 / 11 |