neotraverse
traverse and transform objects by visiting every node on a recursive walk
17
Versions
MIT
License
No
Install Scripts
Verified
Provenance
Supply chain provenance
Status for the latest visible version.
SLSA provenance attestation
npm registry signatures
No source commit
Maintainers
puruvj
Keywords
clonedeepforEachmaprecursivetraversewalk
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| provenance | publisher-changed | AI (provenance): Moved to GitHub Actions CI publishing with SLSA provenance; same repo owner. | ai | |
| publish-pattern | dormant-publish | AI (publish-pattern): Major version bump after refactor; CI-published with provenance from original repo. | ai | |
| phantom-deps | phantom-dep:klona | AI (phantom-deps): klona is a legitimate deep-clone library declared in dependencies; its use in a traversal/transform package is expected and benign. | ai | |
| dependencies | unvetted-dep:gopd | AI (dependencies): gopd is a well-known Jordan Harband utility for own property descriptors; legitimate dependency for an object traversal library. | ai | |
| provenance | no-provenance | AI (provenance): Package predates widespread Sigstore provenance adoption; no other risk signals present. | ai | |
| source-diff | obfuscated-file:dist/modern/min/modern.js | AI (source-diff): Minified production build via terser/tsup; standard traverse library code visible in sample. Stable for this package. | ai | |
| provenance | missing-githead | AI (provenance): Package has SLSA provenance attestation; missing gitHead is a minor metadata gap, not a security concern. | ai | |
| source-diff | obfuscated-file:dist/min/index.js | AI (source-diff): Minified production build via terser/tsup; standard traverse library code visible in sample. Stable for this package. | ai |