← Home

re2js

npm Repository Homepage
33
Versions
—
License
No
Install Scripts
Missing
Provenance

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.

Maintainers

leopard_me

Keywords

re2jsre2regex engineredosregex

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
source-diff encoded-string-file:build/index.cjs AI (source-diff): Unicode range tables for regex character classes; inherent to a RE2 port. ai
source-diff encoded-string-file:build/index.js AI (source-diff): Unicode range tables for regex character classes; inherent to a RE2 port. ai
source-diff obfuscated-file:build/index.cjs AI (source-diff): Bundled build output from rolldown; readable source with region markers, not obfuscation. ai
source-diff obfuscated-file:build/index.js AI (source-diff): Bundled build output from rolldown; readable source with region markers, not obfuscation. ai
source-diff net-exec-file:build/index.cjs AI (source-diff): Regex engine bundle; no actual network or exec calls — pattern match on bundled code. ai
source-diff net-exec-file:build/index.js AI (source-diff): Regex engine bundle; no actual network or exec calls — pattern match on bundled code. ai
source-diff encoded-string-file:build/index.cjs.cjs AI (source-diff): Long encoded strings are Unicode range table data for RE2's character category engine (decodeRanges/UnicodeRangeTable). This is expected and stable for re2js across all versions. ai
source-diff encoded-string-file:build/index.esm.js AI (source-diff): Same Unicode range encoding pattern as index.cjs.cjs — legitimate RE2 character category data, not a malicious payload. ai
source-diff encoded-string-file:build/index.umd.js AI (source-diff): Same Unicode range encoding pattern — legitimate RE2 character category data present in all build targets of re2js. ai
typosquat typosquat.levenshtein:rxjs AI (typosquat): re2js is a legitimate JS port of Google's RE2 regex engine; the name similarity to 'rxjs' is purely mechanical (Levenshtein=2) with no impersonation intent. ai
typosquat typosquat.levenshtein:redis AI (typosquat): re2js is a legitimate JS port of Google's RE2 regex engine; the name similarity to 'redis' is purely mechanical (Levenshtein=2) with no impersonation intent. ai

Versions (showing 33 of 33)

Version Deps Published
2.8.6 0 / 19
2.8.5 0 / 19
2.8.4 0 / 19
2.8.3 0 / 19
2.8.2 0 / 19
2.8.1 0 / 19
2.8.0 0 / 24
2.7.1 0 / 24
2.7.0 0 / 24
2.6.1 0 / 24
2.6.0 0 / 24
2.5.0 0 / 21
2.4.0 0 / 21
2.3.2 0 / 21
2.3.1 0 / 21
2.3.0 0 / 21
2.2.3 0 / 21
2.2.2 0 / 21
2.2.1 0 / 21
2.2.0 0 / 21
2.1.1 0 / 21
2.1.0 0 / 21
2.0.2 0 / 21
2.0.1 0 / 21
2.0.0 0 / 21
1.4.0 0 / 21
1.3.3 0 / 21
1.3.2 0 / 21
1.3.1 0 / 21
1.3.0 0 / 21
1.2.3 0 / 21
1.2.2 0 / 21
1.2.1 0 / 21

v2.8.6

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.8.5

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.8.4

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.