@formatjs/icu-messageformat-parser
Hand-written ICU MessageFormat parser with compatible output as [`intl-messageformat-parser`](https://www.npmjs.com/package/intl-messageformat-parser) but 6 - 10 times as fast.
1
Versions
MIT
License
No
Install Scripts
Verified
Provenance
Supply chain provenance
Status for the latest visible version.
SLSA provenance attestation
npm registry signatures
No source commit
Maintainers
longlhoredonkuluspyrocat
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| provenance | missing-githead | AI (provenance): Missing gitHead is a publish environment change for this package; no security implication given the package's history and legitimate maintainer context. | ai | |
| phantom-deps | phantom-dep:tslib | AI (phantom-deps): tslib is a declared runtime dependency injected by the TypeScript compiler; it is not directly imported in source but is a legitimate runtime dep. Stable false positive for TypeScript packages. | ai | |
| npm-metadata | no-description | AI (npm-metadata): This is a well-known FormatJS monorepo sub-package; missing description is a stable characteristic, not a malice indicator. | ai | |
| provenance | publisher-changed | AI (provenance): Publisher change from longlho to pyrocat is a known legitimate FormatJS maintainer transition, already marked as accepted risk. | ai | |
| dependencies | unvetted-dep:@formatjs/icu-skeleton-parser | AI (dependencies): @formatjs/icu-skeleton-parser is a sibling package in the same official FormatJS monorepo; the dependency relationship is legitimate and expected across all versions of this package. | ai |
Versions (showing 1 of 101)
| Version | Deps | Published |
|---|---|---|
| 0.2.0 | 3 / 0 |
v0.2.0
1 finding
LOW
No provenance attestation
provenance
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.