← Home

flow-parser

npm Repository Homepage

JavaScript parser written in OCaml. Produces ESTree AST

51
Versions
MIT
License
No
Install Scripts
Missing
Provenance

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures No source commit

Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.

Maintainers

mrochgabelevinmoteflowtypesamwgoldmanavikchaudhurimarcoww

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
source-diff obfuscated-file:dist/FlowParserWASM.js AI (source-diff): Emscripten WASM glue code; expected output for OCaml/C++-compiled parser. ai
source-diff large-new-source-files AI (source-diff): Restructured dist output; normal for this package's build pipeline. ai
source-diff obfuscated-file:oxidized/FlowParserWASM.js AI (source-diff): Emscripten WASM glue code; expected for this package's OCaml→WASM compilation pipeline. ai
semgrep semgrep:base64-decode AI (semgrep): Base64 in WASM loader glue is standard Emscripten output. ai
provenance publisher-changed AI (provenance): marcoww has been the publisher for 411 approved versions over 133 days; legitimate maintainer transition for facebook/flow. ai
maintainer-change maintainer-added AI (maintainer-change): marcoww is the established publisher for flow-parser; maintainer addition is a legitimate team transition. ai
npm-metadata suspicious-initial-version AI (npm-metadata): flow-parser uses 0.0.0 as a documented stub/placeholder version. Package is 11 years old with 6M weekly downloads — not a throwaway. ai
bogus-package bogus-package AI (bogus-package): flow-parser is a legitimate high-traffic package (6M downloads/week). Its minimal metadata and tiny payload reflect its role as a compiled OCaml wrapper stub, not spam. ai

Versions (showing 51 of 425)

View all versions
Version Deps Published
0.324.0 1 / 11
0.323.0 1 / 11
0.322.0 1 / 11
0.321.0 1 / 11
0.320.0 1 / 11
0.319.0 1 / 11
0.318.0 0 / 12
0.317.0 0 / 4
0.316.0 0 / 4
0.315.0 0 / 4
0.314.0 0 / 4
0.313.0 0 / 4
0.312.1 0 / 4
0.312.0 0 / 4
0.311.0 0 / 4
0.310.0 0 / 4
0.309.0 0 / 4
0.308.0 0 / 4
0.307.1 0 / 4
0.307.0 0 / 4
0.306.1 0 / 4
0.306.0 0 / 4
0.305.1 0 / 4
0.305.0 0 / 4
0.304.0 0 / 4
0.303.0 0 / 4
0.302.0 0 / 4
0.301.0 0 / 4
0.300.0 0 / 4
0.299.0 0 / 4
0.298.0 0 / 4
0.297.0 0 / 4
0.296.1 0 / 4
0.296.0 0 / 4
0.295.0 0 / 4
0.294.0 0 / 4
0.293.0 0 / 4
0.292.0 0 / 4
0.291.0 0 / 4
0.290.0 0 / 4
0.289.0 0 / 4
0.288.0 0 / 4
0.287.0 0 / 4
0.286.0 0 / 4
0.285.0 0 / 4
0.284.0 0 / 4
0.283.0 0 / 4
0.282.0 0 / 4
0.281.0 0 / 4
0.280.0 0 / 4
0.279.0 0 / 4

v0.324.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.323.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.322.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.