xregexp
Extended regular expressions
25
Versions
MIT
License
No
Install Scripts
Missing
Provenance
Supply chain provenance
Status for the latest visible version.
No SLSA provenance
npm registry signatures
gitHead linked
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
slevithanjosephfrazier
Keywords
regexregexpregular expressionunicode
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | obfuscated-file:lib/addons/unicode-categories.js | AI (source-diff): Long lines are Unicode code point range data (\uXXXX sequences), not obfuscation. This is expected for Unicode data files in XRegExp's Unicode addon modules. | ai | |
| source-diff | obfuscated-file:lib/addons/unicode-properties.js | AI (source-diff): Long lines are Unicode code point range data (\uXXXX sequences), not obfuscation. This is expected for Unicode data files in XRegExp's Unicode addon modules. | ai | |
| source-diff | obfuscated-file:tools/output/properties.js | AI (source-diff): Same as categories.js — Unicode property range data generated by build tooling. Legitimate build artifact for xregexp's Unicode support. | ai | |
| source-diff | obfuscated-file:tools/output/categories.js | AI (source-diff): Long lines are dense Unicode codepoint range strings — build output from unicode data processing scripts. Expected artifact for a Unicode regex library, not obfuscation. | ai | |
| semgrep | semgrep:dynamic-require | AI (semgrep): Dynamic require in build tooling scripts to load versioned unicode data packages (devDependencies). Not a runtime risk; standard pattern for build-time data generation. | ai | |
| provenance | publisher-changed | AI (provenance): slevithan is the original author of XRegExp; the transition from josephfrazier back to slevithan is a legitimate handoff to the package's creator, not a compromise. | ai | |
| source-diff | net-exec-file:lib/xregexp-all.js | AI (source-diff): The file uses standard CommonJS require() and a UMD wrapper — no actual network calls or malicious dynamic execution. False positive on a legitimate browserified bundle. | ai | |
| source-diff | obfuscated-file:lib/xregexp-all.js | AI (source-diff): xregexp-all.js is a documented browserify build artifact (see build script in package.json). Long lines are from minified/bundled output, not obfuscation. Stable false positive for this package. | ai |
Versions (showing 25 of 25)
| Version | Deps | Published |
|---|---|---|
| 5.1.2 | 1 / 15 | |
| 5.1.1 | 1 / 16 | |
| 5.1.0 | 1 / 17 | |
| 5.0.2 | 1 / 17 | |
| 5.0.1 | 1 / 17 | |
| 5.0.0 | 1 / 17 | |
| 4.4.1 | 1 / 15 | |
| 4.4.0 | 1 / 15 | |
| 4.3.0 | 1 / 14 | |
| 4.2.4 | 1 / 14 | |
| 4.2.3 | 1 / 14 | |
| 4.2.2 | 1 / 14 | |
| 4.2.0 | 0 / 13 | |
| 4.1.1 | 0 / 12 | |
| 4.1.0 | 0 / 12 | |
| 4.0.0 | 0 / 9 | |
| 3.2.0 | 0 / 2 | |
| 3.1.1 | 0 / 1 | |
| 3.1.0 | 0 / 1 | |
| 3.0.0 | 0 / 0 | |
| 2.0.0 | 0 / 1 | |
| 1.5.3 | 0 / 0 | |
| 1.5.2 | 0 / 0 | |
| 1.5.1 | 0 / 0 | |
| 1.5.0 | 0 / 0 |