6to5 — Greenflagged

Turn ES6 code into readable vanilla ES5 with source maps

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.

Maintainers

sebmck

Keywords

harmonyclassesmodulesletconstvares6transpiletranspiler6to5

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
source-diff	net-exec-file:packages/6to5-runtime/regenerator/runtime.js	AI (source-diff): Facebook regenerator runtime bundle; legitimate runtime dependency.	ai	2026/05/30
source-diff	net-exec-file:packages/6to5-runtime/core-js.js	AI (source-diff): Bundled core-js 0.4.5 polyfill matching declared dependency; not malware.	ai	2026/05/30
source-diff	net-exec-file:lib/6to5/to-fast-properties.js	AI (source-diff): Dead-code eval after return statement; V8 fast-properties trick from Bluebird. No network calls in this file.	ai	2026/05/26
semgrep	semgrep:new-function-constructor	AI (semgrep): Core transpiler behavior: executes user-supplied transformed code in browser API; expected pattern for this package.	ai	2026/05/22
semgrep	semgrep:eval-usage	AI (semgrep): to-fast-properties V8 optimization trick; eval(obj) after unreachable return is a known perf pattern, not malicious.	ai	2026/05/22
semgrep	semgrep:dynamic-require	AI (semgrep): Module formatter plugin loader; resolves user-configured module format types, stable pattern for this transpiler.	ai	2026/05/22
phantom-deps	phantom-dep:kexec	AI (phantom-deps): kexec is declared as an optionalDependency and used conditionally in CLI code; phantom-dep detection is a false positive here.	ai	2026/04/24
source-diff	net-exec-file:lib/6to5/api/browser.js	AI (source-diff): browser.js is the legitimate browser API for the 6to5 transpiler; XHR+new Function() is the documented mechanism for fetching and running transpiled scripts in-browser. Not malware.	ai	2026/04/24
phantom-deps	phantom-dep:useragent	AI (phantom-deps): useragent is a declared dependency used in server-side register/node code; false positive for this package.	ai	2026/04/24
phantom-deps	phantom-dep:roadrunner	AI (phantom-deps): roadrunner is a declared dependency used for caching in the CLI; false positive for this package.	ai	2026/04/24
source-diff	net-exec-file:lib/6to5/helpers/to-fast-properties.js	AI (source-diff): The eval() in to-fast-properties.js is dead code after a return statement — a documented V8 fast-properties optimization trick from Bluebird. No network call exists in this file. False positive for this package.	ai	2026/04/24

Versions (showing 51 of 257)

View all versions

Version	Deps	Published
3.6.5	23 / 12	2015-02-14
3.6.4	23 / 12	2015-02-14
3.6.3	23 / 12	2015-02-14
3.6.2	23 / 12	2015-02-13
3.6.1	23 / 12	2015-02-13
3.6.0	23 / 12	2015-02-12
3.5.3	24 / 11	2015-02-08
3.5.2	24 / 11	2015-02-08
3.5.1	24 / 11	2015-02-08
3.5.0	24 / 11	2015-02-08
3.4.1	24 / 11	2015-02-07
3.4.0	24 / 11	2015-02-06
3.3.12	24 / 11	2015-02-04
3.3.11	24 / 11	2015-02-04
3.3.10	24 / 11	2015-02-04
3.3.9	24 / 11	2015-02-03
3.3.7	24 / 11	2015-02-03
3.3.5	24 / 11	2015-02-03
3.3.4	24 / 11	2015-02-02
3.3.3	24 / 11	2015-02-01
3.3.2	24 / 11	2015-02-01
3.3.1	24 / 11	2015-02-01
3.3.0	24 / 11	2015-02-01
3.2.1	24 / 11	2015-01-31
3.2.0	24 / 11	2015-01-30
3.1.1	24 / 10	2015-01-30
3.1.0	24 / 10	2015-01-29
3.0.16	24 / 10	2015-01-29
3.0.15	23 / 10	2015-01-29
3.0.14	23 / 10	2015-01-29
3.0.13	23 / 10	2015-01-28
3.0.12	23 / 10	2015-01-28
3.0.11	22 / 10	2015-01-28
3.0.10	22 / 10	2015-01-28
3.0.9	22 / 10	2015-01-28
3.0.8	22 / 10	2015-01-28
3.0.7	22 / 10	2015-01-28
3.0.6	22 / 10	2015-01-28
3.0.5	22 / 10	2015-01-28
3.0.4	22 / 10	2015-01-28
3.0.3	22 / 10	2015-01-28
3.0.2	22 / 10	2015-01-28
3.0.1	22 / 10	2015-01-28
3.0.0	22 / 10	2015-01-28
2.13.7	19 / 8	2015-01-24
2.13.6	19 / 8	2015-01-24
2.13.5	19 / 8	2015-01-21
2.13.4	19 / 8	2015-01-20
2.13.3	19 / 8	2015-01-18
2.13.2	19 / 8	2015-01-18
2.13.1	19 / 8	2015-01-18

v3.6.5

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.6.4

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.6.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.6.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.6.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.6.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.5.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.5.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.5.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.5.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.4.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.4.0

2 findings

HIGH New file with network + code execution: lib/6to5/api/browser.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.3.12

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.3.11

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.3.10

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.3.9

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.3.7

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.3.5

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.3.4

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.3.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.3.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.3.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.3.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.2.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.2.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.1.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.1.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.0.16

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.0.15

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.0.14

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.0.13

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.0.12

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.0.11

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.0.10

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.0.9

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.0.8

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.0.7

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.0.6

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.0.5

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.0.4

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.0.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.0.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.0.1

2 findings

HIGH New file with network + code execution: lib/6to5/helpers/to-fast-properties.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.0.0

2 findings

HIGH New file with network + code execution: lib/6to5/helpers/to-fast-properties.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.13.7

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.13.6

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.13.5

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.13.4

3 findings

HIGH New file with network + code execution: packages/6to5-runtime/core-js.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

HIGH New file with network + code execution: packages/6to5-runtime/regenerator/runtime.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.13.3

2 findings

HIGH New file with network + code execution: lib/6to5/to-fast-properties.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.13.2

2 findings

HIGH New file with network + code execution: lib/6to5/to-fast-properties.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.13.1

2 findings

HIGH New file with network + code execution: lib/6to5/to-fast-properties.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.