flatten

Flatten arbitrarily nested arrays into a non-nested list of non-array items. Maintained for legacy compatibility.

Supply chain provenance

Status for the latest visible version.

Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.

Maintainers

Keywords

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
npm-metadata	suspicious-initial-version	AI (npm-metadata): Package is 13+ years old; 0.0.0 was common in early npm era. Publisher has strong track record. Not a malware indicator for this package.	ai	2026/04/24
bogus-package	bogus-package	AI (bogus-package): Tiny payload and no deps are consistent with a simple array-flatten utility. Legitimate minimal package from a trusted long-standing publisher.	ai	2026/04/24
provenance	publisher-changed	AI (provenance): mk-pmb is the documented new maintainer; repo URL points to their fork, description explicitly states legacy maintenance. Legitimate handoff, not a compromise.	ai	2026/04/23
maintainer-change	maintainer-added	AI (maintainer-change): mk-pmb added as maintainer is consistent with the documented ownership transfer; no malicious indicators present.	ai	2026/04/23
publish-pattern	dormant-publish	AI (publish-pattern): Dormancy followed by mk-pmb's publish is explained by the original author abandoning the package and mk-pmb adopting it for legacy compatibility. No code changes introduced.	ai	2026/04/23

Version	Deps	Published
1.0.3	0 / 0	2019-10-31
1.0.2	0 / 0	2016-01-20
1.0.1	0 / 0	2016-01-20
1.0.0	0 / 0	2016-01-20
0.0.1	0 / 0	2012-06-28
0.0.0	0 / 0	2012-06-28