re2
Bindings for RE2: fast, safe alternative to backtracking regular expression engines.
11
Versions
BSD-3-Clause
License
Yes
Install Scripts
Missing
Provenance
Supply chain provenance
Status for the latest visible version.
No SLSA provenance
npm registry signatures
gitHead linked
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
elazutkin
Keywords
RegExpRegExtext processingPCRE alternative
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| npm-metadata | bundled-binaries | AI (npm-metadata): re2 is a native Node.js addon; bundled .o and .node files are the expected compiled output of the RE2 C++ library and its bindings. Stable pattern for this package. | ai | |
| source-diff | net-exec-file:tests/test_matchAll.js | AI (source-diff): The eval() calls are heya-unit's test assertion idiom (eval(t.TEST(...))); no actual network calls exist in this test file. This is a stable false positive for this package's test suite pattern. | ai | |
| license | uncommon-license:New BSD | AI (license): New BSD is a well-known permissive license; the uncommon flag is a false positive for this package. | ai | |
| semgrep | semgrep:child-process-import | AI (semgrep): child_process is used only in a dev/CI script (create-binary-asset.js) for packaging GitHub release binaries, not in runtime or install code. Expected for a native addon package. | ai | |
| publish-pattern | new-deps-added | AI (publish-pattern): install-artifact-from-github is a legitimate helper for fetching prebuilt native binaries from GitHub releases; consistent with re2's documented install flow for native bindings. | ai | |
| phantom-deps | phantom-dep:nan | AI (phantom-deps): nan is a standard native addon build dependency referenced in binding.gyp, not a runtime import. Expected for this package. | ai | |
| phantom-deps | phantom-dep:node-gyp | AI (phantom-deps): node-gyp is the standard build tool for native Node.js addons; its presence as an implicit dependency is expected for re2. | ai | |
| phantom-deps | phantom-dep:install-artifact-from-github | AI (phantom-deps): install-artifact-from-github is the prebuilt binary fetcher used in re2's install script — expected and stable for this package. | ai | |
| install-scripts | install-script:install | AI (install-scripts): re2 is a native Node.js addon; its install script fetches prebuilt binaries or builds via node-gyp — the canonical pattern for native bindings, stable across all versions. | ai |
Versions (showing 11 of 11)
| Version | Deps | Published |
|---|---|---|
| 1.20.10 | 3 / 3 | |
| 1.20.8 | 3 / 3 | |
| 1.17.3 | 3 / 1 | |
| 1.16.0 | 3 / 1 | |
| 1.15.9 | 3 / 1 | |
| 1.15.8 | 3 / 1 | |
| 1.8.4 | 1 / 1 | |
| 1.5.0 | 1 / 1 | |
| 1.4.1 | 1 / 1 | |
| 1.2.0 | 1 / 1 | |
| 0.9.0 | 1 / 1 |
v0.9.0
1 finding
LOW
No provenance attestation
provenance
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.