traceur

ES6 to ES5 compiler

Supply chain provenance

Status for the latest visible version.

Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.

Maintainers

Keywords

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
source-diff	source-size-tripled	AI (source-diff): Size increase reflects bundling the compiled compiler and runtime into bin/ files, replacing the regexpu dep. Expected for a transpiler shipping self-contained binaries.	ai	2026/04/24
source-diff	obfuscated-file:bin/traceur.js	AI (source-diff): bin/traceur.js is Traceur's bundled/minified compiler output — standard practice for this transpiler tool. Long lines are from minification, not obfuscation. Stable for this package.	ai	2026/04/24
source-diff	obfuscated-file:dist/commonjs/outputgeneration/regexpuRewritePattern.js	AI (source-diff): This is a bundled/compiled version of the regexpu library in Traceur's dist/ output. Long lines are expected minified build artifacts for this transpiler project, not obfuscation.	ai	2026/04/24
publish-pattern	new-deps-added	AI (publish-pattern): source-map-support is a well-known, benign package; its addition is natural for a compiler/transpiler like Traceur.	ai	2026/04/24
semgrep	semgrep:new-function-constructor	AI (semgrep): Usage is in vendored Google Closure Library; the pattern is a trivial identity function (return a) — benign and stable across versions.	ai	2026/04/24
source-diff	source-size-dropped	AI (source-diff): Size drop is explained by the explicit 'files' whitelist in package.json scoping the publish to only src/node/*.js and bin/ files — a deliberate packaging optimization, not code replacement.	ai	2026/04/24
source-diff	obfuscated-file:bin/BrowserSystem.js	AI (source-diff): BrowserSystem.js is a legitimate minified browser bundle for the Traceur compiler runtime. Long lines are expected in bundled build artifacts for this transpiler package.	ai	2026/04/24
source-diff	net-exec-file:src/util/parseProlog.js	AI (source-diff): parseProlog.js is a legitimate compiler utility parsing comment directives in source files. The eval() evaluates skip-directive expressions from test files; the 'network' signal is a false positive from ES6 import statements, not actual network calls.	ai	2026/04/24
provenance	publisher-changed	AI (provenance): Publisher change johnjbarton→arv occurred in 2014; arv has 575 approved packages and is a known Google Traceur maintainer. Historical transition, not a compromise.	ai	2026/04/24
phantom-deps	phantom-dep:semver	AI (phantom-deps): semver is declared in both dependencies and devDependencies; phantom-dep finding is a false positive for this package's build/config usage pattern.	ai	2026/04/24
phantom-deps	phantom-dep:regexpu	AI (phantom-deps): regexpu is a legitimate runtime dependency for Unicode regex support in the transpiler; indirect usage via config is expected.	ai	2026/04/24
license	uncommon-license:Apache License 2.0	AI (license): Apache License 2.0 is a standard permissive license used by Google projects; the 'uncommon' flag is a false positive for this well-known license string.	ai	2026/04/24
semgrep	semgrep:dynamic-require	AI (semgrep): Dynamic require is core functionality in traceur-runtime.js — it implements module resolution for transpiled ES6 code. Expected and stable for this compiler package.	ai	2026/04/23
provenance	no-provenance	AI (provenance): Established Google-authored package (4791 days old) with consistent publisher history; lack of Sigstore provenance is expected for this era of package.	ai	2026/04/23
semgrep	semgrep:eval-usage	AI (semgrep): eval() in parseProlog.js is used to evaluate prolog directives in source files being compiled — inherent to a JS compiler/transpiler's design.	ai	2026/04/23

Version	Deps	Published
0.0.4	1 / 3	2013-08-01
0.0.3	1 / 2	2013-04-23
0.0.2	1 / 1	2013-03-22
0.0.1	1 / 0	2013-03-11