@fast-csv/parse — Greenflagged

fast-csv parsing package

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.

Maintainers

damartinzackerydevjuan-c2fodustinsmith1024

Keywords

csvparsefast-csvparser

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
dependencies	unvetted-dep:lodash.isnil	AI (dependencies): lodash.isnil is a stable, well-known lodash utility sub-package with a long npm history; unvetted status is a registry artifact, not a security concern for this package.	ai	2026/04/22
dependencies	unvetted-dep:lodash.groupby	AI (dependencies): lodash.groupby is a stable, well-known lodash utility sub-package; unvetted status is a registry artifact, not a security concern for this package.	ai	2026/04/22
dependencies	unvetted-dep:lodash.isfunction	AI (dependencies): lodash.isfunction is a stable, well-known lodash utility sub-package; unvetted status is a registry artifact, not a security concern for this package.	ai	2026/04/22
dependencies	unvetted-dep:lodash.escaperegexp	AI (dependencies): lodash.escaperegexp is a stable, well-known lodash utility sub-package; unvetted status is a registry artifact, not a security concern for this package.	ai	2026/04/22
typosquat	typosquat.levenshtein:parcel	AI (typosquat): @fast-csv/parse is the official C2FO fast-csv CSV parsing package with 6+ years of history; similarity to 'parcel' is coincidental and not a typosquat.	ai	2026/04/22

Versions (showing 5 of 5)

Version	Deps	Published
5.0.7	3 / 8	2026-05-06
5.0.5	6 / 11	2025-08-04
5.0.2	6 / 11	2024-10-22
5.0.0	6 / 11	2024-01-13
4.3.6	7 / 10	2020-12-04

v5.0.7

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.