unicoderegexp
Regular expressions for various Unicode character classes extracted from XRegExp
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | obfuscated-file-transition:lib/unicodeRegExp.js | AI (source-diff): Long line is an inlined Unicode character-class regex table, not obfuscated logic. | ai | |
| phantom-deps | phantom-dep:passerror | AI (phantom-deps): Old CJS utility package; likely used but not caught by static import scan. | ai | |
| phantom-deps | phantom-dep:one-validation | AI (phantom-deps): Old CJS utility package; likely used but not caught by static import scan. | ai | |
| phantom-deps | phantom-dep:ain2-papandreou | AI (phantom-deps): Optional dep by same publisher; benign. | ai |
Versions (showing 10 of 10)
| Version | Deps | Published |
|---|---|---|
| 0.4.1 | 0 / 3 | |
| 0.4.0 | 0 / 3 | |
| 0.3.1 | 0 / 3 | |
| 0.3.0 | 0 / 3 | |
| 0.2.4 | 1 / 2 | |
| 0.2.3 | 1 / 2 | |
| 0.2.2 | 1 / 3 | |
| 0.2.1 | 1 / 3 | |
| 0.2.0 | 1 / 3 | |
| 0.1.0 | 5 / 3 |
v0.4.0
2 findingsThis file was readable in the previously greenflagged version and is now minified or obfuscated (lines over 3000 chars). A file that gains obfuscation between releases is a strong payload-swap indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.3.1
3 findingsThis file was readable in the previously greenflagged version and is now minified or obfuscated (lines over 3000 chars). A file that gains obfuscation between releases is a strong payload-swap indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (papandreou) than the most recent previously approved version (maartenwinter) on 2015-08-07, but papandreou is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v0.3.0
3 findingsThis file was readable in the previously greenflagged version and is now minified or obfuscated (lines over 3000 chars). A file that gains obfuscation between releases is a strong payload-swap indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (papandreou) than the most recent previously approved version (maartenwinter) on 2014-03-18, but papandreou is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v0.2.4
2 findingsThis version was published by a different npm account (maartenwinter) than the most recent previously approved version (papandreou) on 2014-03-17. It has since remained available on npm for 4508 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.2.3
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.2.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.2.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.2.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.1.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.