autolinker — Greenflagged

Utility to automatically link the URLs, email addresses, phone numbers, hashtags, and mentions (Twitter, Instagram) in a given block of text/HTML

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.

Maintainers

gregjacobsolafleur

Keywords

autolinkautolinkurlurlsanchor

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
source-diff	obfuscated-file:dist/autolinker.js	AI (source-diff): dist/autolinker.js is a standard UMD bundle generated by rollup/webpack from TypeScript sources; long lines are expected in bundled output, not obfuscation. Stable for this package.	ai	2026/04/24
source-diff	obfuscated-file:dist/es2015/parser/known-tlds.js	AI (source-diff): Same as commonjs variant — auto-generated TLD regex file with explicit comment. ES2015 module build of the same legitimate generated artifact.	ai	2026/04/24
install-scripts	install-script:preinstall	AI (install-scripts): Preinstall runs `npx -y only-allow pnpm` which enforces pnpm as the package manager. This is a benign developer-experience pattern with no malicious behavior.	ai	2026/04/24
source-diff	obfuscated-file:dist/commonjs/parser/known-tlds.js	AI (source-diff): File is an auto-generated TLD regex list (explicitly commented as such). Long lines are due to hundreds of valid IANA TLD alternations, not obfuscation. Expected artifact for an autolinker library.	ai	2026/04/24
source-diff	obfuscated-file:dist/commonjs/parser/tld-regex.d.ts	AI (source-diff): TypeScript declaration file for the generated TLD regex. Long line is the TLD string constant declaration, not obfuscation.	ai	2026/04/24
source-diff	obfuscated-file:dist/commonjs/parser/tld-regex.js	AI (source-diff): This file is a generated TLD regex list from IANA, explicitly documented as such in the file header and package.json scripts. Long single-line regex is expected for this package's URL-matching functionality.	ai	2026/04/24
source-diff	obfuscated-file:dist/es2015/parser/tld-regex.js	AI (source-diff): Same as commonjs variant — generated TLD regex list, not obfuscated malicious code. Expected artifact for autolinker's URL matching.	ai	2026/04/24
source-diff	obfuscated-file:dist/es2015/parser/tld-regex.d.ts	AI (source-diff): TypeScript declaration file for the generated TLD regex (es2015 variant). Long line is the TLD string constant declaration, not obfuscation.	ai	2026/04/24
source-diff	obfuscated-file:dist/commonjs/char-utils.js	AI (source-diff): Generated file with long lines from binary-search Unicode range checks. Clearly documented as auto-generated, readable utility functions, consistent with added generate-char-utils script.	ai	2026/04/23
source-diff	obfuscated-file:dist/es2015/char-utils.d.ts	AI (source-diff): Generated TypeScript declaration file with long lines from Unicode range documentation. Clearly documented as auto-generated, contains only type declarations.	ai	2026/04/23
source-diff	obfuscated-file:dist/commonjs/char-utils.d.ts	AI (source-diff): Generated TypeScript declaration file with long lines from Unicode range documentation. Clearly documented as auto-generated, contains only type declarations.	ai	2026/04/23
source-diff	obfuscated-file:dist/es2015/char-utils.js	AI (source-diff): Generated file with long lines from binary-search Unicode range checks. Clearly documented as auto-generated, readable utility functions, consistent with added generate-char-utils script.	ai	2026/04/23

Versions (showing 51 of 94)

View all versions

Version	Deps	Published
4.1.5	1 / 48	2025-05-01
4.1.4	1 / 48	2025-04-29
4.1.3	1 / 48	2025-04-29
4.1.1	1 / 48	2025-04-28
4.1.0	1 / 39	2024-12-26
4.0.2	1 / 39	2024-12-25
4.0.1	1 / 38	2024-12-16
4.0.0	1 / 38	2022-09-07
3.16.2	1 / 36	2022-09-07
3.16.1	1 / 36	2022-09-07
3.16.0	1 / 36	2022-08-17
3.15.0	1 / 34	2022-02-27
3.14.3	1 / 39	2021-03-14
3.14.2	1 / 39	2020-10-30
3.14.1	1 / 39	2020-04-08
3.14.0	1 / 39	2020-04-05
3.13.0	1 / 39	2020-02-27
3.12.0	1 / 39	2020-02-15
3.11.1	1 / 39	2019-10-06
3.11.0	1 / 39	2019-07-31
3.1.0	1 / 39	2019-06-05
3.0.5	1 / 39	2019-03-17
3.0.4	1 / 39	2019-03-07
3.0.3	1 / 39	2019-02-20
3.0.2	1 / 39	2019-02-20
3.0.1	1 / 39	2019-02-18
3.0.0	1 / 39	2019-01-23
2.2.2	1 / 35	2019-01-10
2.2.1	0 / 33	2018-12-28
2.2.0	0 / 33	2018-12-28
2.1.0	0 / 33	2018-12-27
2.0.0	0 / 33	2018-12-27
1.8.3	0 / 28	2018-12-19
1.8.1	0 / 28	2018-11-18
1.8.0	0 / 28	2018-11-18
1.7.1	0 / 28	2018-08-07
1.7.0	0 / 28	2018-07-24
1.6.2	0 / 28	2018-02-10
1.6.1	0 / 28	2018-02-03
1.6.0	0 / 28	2017-11-07
1.5.0	0 / 28	2017-11-07
1.4.4	0 / 28	2017-09-12
1.4.3	0 / 28	2017-04-06
1.4.2	0 / 28	2017-03-03
1.4.1	0 / 25	2017-02-19
1.4.0	0 / 25	2016-11-26
1.3.4	0 / 25	2016-11-21
1.3.2	0 / 25	2016-11-21
1.3.1	0 / 25	2016-11-21
1.3.0	0 / 25	2016-11-21
1.2.2	0 / 25	2016-11-21

v4.1.5

5 findings

HIGH New obfuscated file: dist/commonjs/char-utils.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/es2015/char-utils.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/commonjs/char-utils.d.ts source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/es2015/char-utils.d.ts source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v4.1.4

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v4.1.3

4 findings

HIGH Package has 'preinstall' script install-scripts

Script: npx -y only-allow pnpm

HIGH New obfuscated file: dist/commonjs/parser/known-tlds.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/es2015/parser/known-tlds.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v4.1.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v4.1.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v4.0.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v4.0.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v4.0.0

5 findings

HIGH New obfuscated file: dist/commonjs/parser/tld-regex.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/es2015/parser/tld-regex.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/commonjs/parser/tld-regex.d.ts source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/es2015/parser/tld-regex.d.ts source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.16.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.16.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.16.0

2 findings

HIGH New obfuscated file: dist/autolinker.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.15.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.14.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.14.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.14.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.14.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.13.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.12.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.11.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.11.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.1.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.0.5

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.0.4

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.0.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.0.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.0.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.0.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.