hbs

Express.js template engine plugin for Handlebars

Supply chain provenance

Status for the latest visible version.

Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.

Maintainers

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
maintainer-change	maintainer-takeover	AI (maintainer-change): dougwilson is the Express.js maintainer and pillarjs org member; this is a legitimate ecosystem transfer, not a hijack.	ai	2026/04/24
provenance	publisher-changed	AI (provenance): Publisher change to dougwilson is a legitimate transfer within the pillarjs/Express ecosystem.	ai	2026/04/24
maintainer-change	maintainer-added	AI (maintainer-change): dougwilson is a trusted, long-standing Express ecosystem maintainer.	ai	2026/04/24
maintainer-change	maintainer-removed	AI (maintainer-change): Previous maintainers replaced by dougwilson as part of legitimate pillarjs org maintenance.	ai	2026/04/24

Version	Deps	Published
4.2.0	2 / 6	2021-11-17
4.0.2	2 / 3	2019-02-19
2.9.0	2 / 3	2015-03-06
2.8.0	2 / 3	2014-12-26
2.7.0	2 / 3	2014-06-02
2.6.0	2 / 3	2014-04-06
2.5.0	2 / 3	2014-02-19
2.4.0	2 / 3	2013-09-14
2.3.1	2 / 3	2013-08-01
2.3.0	2 / 3	2013-05-30
2.0.2	1 / 3	2013-02-21
2.0.1	1 / 3	2012-11-30
2.0.0	1 / 3	2012-11-21
1.0.9	1 / 3	2012-11-01
1.0.8	1 / 3	2012-10-31
1.0.7	1 / 3	2012-10-25
1.0.6	1 / 3	2012-10-23
1.0.5	1 / 3	2012-08-02
1.0.4	1 / 3	2012-06-21
1.0.3	1 / 3	2012-05-24
1.0.2	1 / 3	2012-05-03
1.0.1	1 / 0	2011-09-13
1.0.0	1 / 0	2011-09-05
0.0.7	0 / 0	2011-03-31
0.0.6	0 / 0	2011-03-18
0.0.5	0 / 0	2011-03-15
0.0.4	0 / 0	2011-01-20
0.0.3	0 / 0	2011-01-20