re2js
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | encoded-string-file:build/index.cjs | AI (source-diff): Unicode range tables for regex character classes; inherent to a RE2 port. | ai | |
| source-diff | encoded-string-file:build/index.js | AI (source-diff): Unicode range tables for regex character classes; inherent to a RE2 port. | ai | |
| source-diff | obfuscated-file:build/index.cjs | AI (source-diff): Bundled build output from rolldown; readable source with region markers, not obfuscation. | ai | |
| source-diff | obfuscated-file:build/index.js | AI (source-diff): Bundled build output from rolldown; readable source with region markers, not obfuscation. | ai | |
| source-diff | net-exec-file:build/index.cjs | AI (source-diff): Regex engine bundle; no actual network or exec calls — pattern match on bundled code. | ai | |
| source-diff | net-exec-file:build/index.js | AI (source-diff): Regex engine bundle; no actual network or exec calls — pattern match on bundled code. | ai | |
| source-diff | encoded-string-file:build/index.cjs.cjs | AI (source-diff): Long encoded strings are Unicode range table data for RE2's character category engine (decodeRanges/UnicodeRangeTable). This is expected and stable for re2js across all versions. | ai | |
| source-diff | encoded-string-file:build/index.esm.js | AI (source-diff): Same Unicode range encoding pattern as index.cjs.cjs — legitimate RE2 character category data, not a malicious payload. | ai | |
| source-diff | encoded-string-file:build/index.umd.js | AI (source-diff): Same Unicode range encoding pattern — legitimate RE2 character category data present in all build targets of re2js. | ai | |
| typosquat | typosquat.levenshtein:rxjs | AI (typosquat): re2js is a legitimate JS port of Google's RE2 regex engine; the name similarity to 'rxjs' is purely mechanical (Levenshtein=2) with no impersonation intent. | ai | |
| typosquat | typosquat.levenshtein:redis | AI (typosquat): re2js is a legitimate JS port of Google's RE2 regex engine; the name similarity to 'redis' is purely mechanical (Levenshtein=2) with no impersonation intent. | ai |
Versions (showing 30 of 30)
| Version | Deps | Published |
|---|---|---|
| 2.8.3 | 0 / 19 | |
| 2.8.2 | 0 / 19 | |
| 2.8.1 | 0 / 19 | |
| 2.8.0 | 0 / 24 | |
| 2.7.1 | 0 / 24 | |
| 2.7.0 | 0 / 24 | |
| 2.6.1 | 0 / 24 | |
| 2.6.0 | 0 / 24 | |
| 2.5.0 | 0 / 21 | |
| 2.4.0 | 0 / 21 | |
| 2.3.2 | 0 / 21 | |
| 2.3.1 | 0 / 21 | |
| 2.3.0 | 0 / 21 | |
| 2.2.3 | 0 / 21 | |
| 2.2.2 | 0 / 21 | |
| 2.2.1 | 0 / 21 | |
| 2.2.0 | 0 / 21 | |
| 2.1.1 | 0 / 21 | |
| 2.1.0 | 0 / 21 | |
| 2.0.2 | 0 / 21 | |
| 2.0.1 | 0 / 21 | |
| 2.0.0 | 0 / 21 | |
| 1.4.0 | 0 / 21 | |
| 1.3.3 | 0 / 21 | |
| 1.3.2 | 0 / 21 | |
| 1.3.1 | 0 / 21 | |
| 1.3.0 | 0 / 21 | |
| 1.2.3 | 0 / 21 | |
| 1.2.2 | 0 / 21 | |
| 1.2.1 | 0 / 21 |
v2.8.3
3 findingsModified file contains 11 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 11 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.8.2
5 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.8.1
5 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.8.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.7.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.7.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.6.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.6.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.5.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.4.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.3.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.2.3
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v2.2.2
4 findingsModified file contains 5 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 5 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 5 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.2.1
4 findingsModified file contains 5 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 5 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 5 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.2.0
4 findingsModified file contains 5 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 5 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 5 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.1.1
4 findingsModified file contains 5 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 5 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 5 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.1.0
4 findingsModified file contains 5 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 5 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 5 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.0.2
4 findingsModified file contains 5 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 5 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 5 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.0.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.0.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.4.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.3.3
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.3.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.3.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.3.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.2.3
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.2.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.2.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.