@babel/parser
A JavaScript parser
51
Versions
MIT
License
No
Install Scripts
Verified
Provenance
Supply chain provenance
Status for the latest visible version.
SLSA provenance attestation
npm registry signatures
No source commit
Maintainers
hzooexistentialismnicolo-ribaudojlhwung
Keywords
babeljavascriptparsertc39ecmascript@babel/parser
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | obfuscated-file:lib/index.d.ts | AI (source-diff): lib/index.d.ts is a legitimate TypeScript declaration file for @babel/parser's public API. Long lines are caused by large union types, not obfuscation. Stable false positive for this package. | ai | |
| maintainer-change | maintainer-added | AI (maintainer-change): developit (Jason Miller) is a reputable, well-known JS ecosystem contributor; addition to Babel org is a legitimate collaboration, not a takeover signal. | ai | |
| provenance | missing-githead | AI (provenance): Missing gitHead is a known artifact of monorepo publish tooling changes in the Babel project; not indicative of tampering for this well-established package. | ai | |
| maintainer-change | maintainer-removed | AI (maintainer-change): Babel team membership has evolved over time; removal of loganfsmyth and danez reflects known team changes, not a takeover. nicolo-ribaudo is a core Babel maintainer. | ai | |
| source-diff | obfuscated-file:lib/util/identifier.js | AI (source-diff): Long lines in identifier.js are Unicode character range tables, a standard pattern in JavaScript parsers. The file is readable, clean code — not obfuscated. | ai | |
| bogus-package | bogus-package | AI (bogus-package): hzoo and loganfsmyth are long-standing Babel core contributors; spam flag is a false positive for this package. | ai | |
| source-diff | large-new-source-files | AI (source-diff): New files are source maps and parser/plugin JS files consistent with a major version bump (7.18.11→7.22.5). Expected growth for a JavaScript parser adding new language features. | ai | |
| publish-pattern | new-deps-added | AI (publish-pattern): @babel/types is a core Babel package added only for type definitions (explicitly documented in package.json). Not a functional runtime dependency and not an attack vector. | ai | |
| provenance | publisher-changed | AI (provenance): Babel project transitioned to GitHub Actions CI/CD publishing — a security improvement over individual account publishing. Consistent with official babel/babel monorepo governance. | ai | |
| provenance | no-provenance | AI (provenance): Babel publishes via GitHub Actions CI without Sigstore attestation; this is consistent across all @babel/* packages and is not a risk indicator. | ai | |
| typosquat | typosquat.levenshtein:parcel | AI (typosquat): @babel/parser is the official Babel JS parser under the @babel scope — a completely distinct, well-established package from 'parcel'. Levenshtein match is a stable false positive for this package. | ai |
Versions (showing 51 of 200)
| Version | Deps | Published |
|---|---|---|
| 7.29.7 | 1 / 6 | |
| 7.29.3 | 1 / 6 | |
| 7.29.2 | 1 / 6 | |
| 7.29.0 | 1 / 6 | |
| 7.28.6 | 1 / 6 | |
| 7.28.5 | 1 / 6 | |
| 7.28.4 | 1 / 6 | |
| 7.28.3 | 1 / 6 | |
| 7.28.0 | 1 / 6 | |
| 7.27.7 | 1 / 6 | |
| 7.27.5 | 1 / 6 | |
| 7.27.4 | 1 / 6 | |
| 7.27.3 | 1 / 6 | |
| 7.27.2 | 1 / 6 | |
| 7.27.1 | 1 / 6 | |
| 7.27.0 | 1 / 6 | |
| 7.26.10 | 1 / 6 | |
| 7.26.9 | 1 / 6 | |
| 7.26.8 | 1 / 6 | |
| 7.26.7 | 1 / 6 | |
| 7.26.5 | 1 / 6 | |
| 7.26.3 | 1 / 6 | |
| 7.26.2 | 1 / 6 | |
| 7.26.1 | 1 / 6 | |
| 7.26.0 | 1 / 6 | |
| 7.25.9 | 1 / 6 | |
| 7.25.8 | 1 / 6 | |
| 7.25.7 | 1 / 6 | |
| 7.25.6 | 1 / 6 | |
| 7.25.4 | 1 / 6 | |
| 7.25.3 | 1 / 6 | |
| 7.25.0 | 0 / 7 | |
| 7.24.8 | 0 / 7 | |
| 7.24.7 | 0 / 7 | |
| 7.24.6 | 0 / 7 | |
| 7.24.5 | 0 / 6 | |
| 7.24.4 | 0 / 6 | |
| 7.24.1 | 0 / 6 | |
| 7.24.0 | 0 / 6 | |
| 7.23.9 | 0 / 6 | |
| 7.23.6 | 0 / 6 | |
| 7.23.5 | 0 / 6 | |
| 7.23.4 | 0 / 6 | |
| 7.23.3 | 0 / 6 | |
| 7.23.0 | 0 / 6 | |
| 7.22.16 | 0 / 6 | |
| 7.22.15 | 0 / 6 | |
| 7.22.14 | 0 / 6 | |
| 7.22.13 | 0 / 6 | |
| 7.22.11 | 0 / 6 | |
| 7.22.10 | 0 / 6 |
v7.29.7
1 finding
INFO
Has SLSA provenance attestation
provenance
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v7.29.3
1 finding
INFO
No provenance attestation
provenance
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.