rip-lang
51
Versions
—
License
Yes
Install Scripts
Missing
Provenance
Supply chain provenance
Status for the latest visible version.
No SLSA provenance
npm registry signatures
No source commit
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
shreeve
Keywords
ripcompilerlanguages-expressionlispbunbrowserparsertranspilerjavascriptes2022coffeescript
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| semgrep | semgrep:shady-links-raw-ip | AI (semgrep): Raw IP appears only in a comment documenting a default localhost dev-server URL, not in executable network code. | ai | |
| phantom-deps | phantom-dep:@types/bun | AI (phantom-deps): @types/bun is a type-declaration package loaded by convention, not via import statements. | ai | |
| source-diff | obfuscated-file:docs/dist/rip.js | AI (source-diff): Browser bundle built by the package's own build script; minified output is expected. | ai | |
| source-diff | net-exec-file:docs/dist/rip.js | AI (source-diff): Compiler bundle legitimately uses dynamic code execution (eval/new Function) as part of its language runtime. | ai | |
| source-diff | net-exec-file:docs/dist/rip.min.js | AI (source-diff): Minified browser bundle of the compiler; same rationale as rip.js. | ai | |
| source-diff | net-exec-file:docs/dist/rip-ui.min.js | AI (source-diff): Minified UI bundle for a language playground; network calls are fetch/XHR for compiler output, not exfiltration. | ai | |
| source-diff | obfuscated-file:src/grammar/parser.js | AI (source-diff): Generated LR parser with long symbol-table lines; header confirms Solar parser generator output, not obfuscation. | ai | |
| provenance | missing-githead | AI (provenance): Established package with 244 versions; missing gitHead alone is not a security signal for this package. | ai | |
| install-scripts | install-script:postinstall | AI (install-scripts): Compiler/language tool with 244 versions; postinstall is a documented setup step, not arbitrary remote code execution. | ai | |
| semgrep | semgrep:new-function-constructor | AI (semgrep): Used to bootstrap reactive/component runtime in browser context; expected pattern for a compile-to-JS language runtime. | ai |
Versions (showing 51 of 242)
| Version | Deps | Published |
|---|---|---|
| 3.16.2 | 2 / 0 | |
| 3.15.4 | 0 / 1 | |
| 3.15.3 | 0 / 1 | |
| 3.15.1 | 0 / 1 | |
| 3.15.0 | 1 / 1 | |
| 3.14.4 | 0 / 1 | |
| 3.14.2 | 0 / 1 | |
| 3.14.1 | 0 / 1 | |
| 3.14.0 | 0 / 1 | |
| 3.13.137 | 0 / 1 | |
| 3.13.136 | 0 / 1 | |
| 3.13.135 | 0 / 1 | |
| 3.13.134 | 0 / 1 | |
| 3.13.133 | 0 / 1 | |
| 3.13.132 | 0 / 1 | |
| 3.13.131 | 0 / 1 | |
| 3.13.130 | 0 / 1 | |
| 3.13.129 | 0 / 1 | |
| 3.13.128 | 0 / 1 | |
| 3.13.127 | 0 / 1 | |
| 3.13.126 | 0 / 1 | |
| 3.13.125 | 0 / 1 | |
| 3.13.124 | 0 / 1 | |
| 3.13.123 | 0 / 1 | |
| 3.13.122 | 0 / 1 | |
| 3.13.121 | 0 / 1 | |
| 3.13.120 | 0 / 1 | |
| 3.13.119 | 0 / 1 | |
| 3.13.118 | 0 / 1 | |
| 3.13.117 | 0 / 1 | |
| 3.13.116 | 0 / 1 | |
| 3.13.115 | 0 / 1 | |
| 3.13.114 | 0 / 1 | |
| 3.13.113 | 0 / 1 | |
| 3.13.112 | 0 / 1 | |
| 3.13.111 | 0 / 1 | |
| 3.13.110 | 0 / 1 | |
| 3.13.109 | 0 / 1 | |
| 3.13.108 | 0 / 1 | |
| 3.13.107 | 0 / 1 | |
| 3.13.106 | 0 / 1 | |
| 3.13.105 | 0 / 1 | |
| 3.13.104 | 0 / 1 | |
| 3.13.103 | 0 / 1 | |
| 3.13.102 | 0 / 1 | |
| 3.13.101 | 0 / 1 | |
| 3.13.100 | 0 / 1 | |
| 3.13.99 | 0 / 1 | |
| 3.13.98 | 0 / 1 | |
| 3.13.97 | 0 / 1 | |
| 3.13.96 | 0 / 1 |