bal-util — Greenflagged

Common utility functions for Node.js used and maintained by Benjamin Lupton

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.

Maintainers

baluptonbevryme

Keywords

javascriptflowcontrolasyncsynctasksbatchutilityutilutilitiespathspatheventseventmodulemodulescomparecomparisonhtml

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
provenance	no-provenance	AI (provenance): Package is 5455 days old; provenance attestation did not exist when it was published. This is expected and stable across all versions of this package.	ai	2026/04/24
phantom-deps	phantom-dep:request	AI (phantom-deps): The request dependency is declared in package.json and referenced in config; minor structural issue with no security implications for this package.	ai	2026/04/24
phantom-deps	phantom-dep:ambi	AI (phantom-deps): ambi is explicitly listed in dependencies and is a legitimate Bevry utility package used by bal-util. Phantom dep detection is a false positive here.	ai	2026/04/24
provenance	publisher-changed	AI (provenance): bevryme is Benjamin Lupton's organization npm account (bevry org); this is a documented legitimate transition, not a compromise. Consistent across all Bevry packages.	ai	2026/04/24
maintainer-change	maintainer-added	AI (maintainer-change): bevryme is the Bevry organization account owned by the original author Benjamin Lupton. Legitimate org account transition.	ai	2026/04/24
semgrep	semgrep:dynamic-require	AI (semgrep): Dynamic require is an intentional feature of bal-util's module management utilities (cache-busting reload). Not a security risk in this context.	ai	2026/04/24
semgrep	semgrep:child-process-import	AI (semgrep): child_process.spawn is used as part of a documented process-execution utility in this general-purpose library. No malicious command construction present.	ai	2026/04/24

Versions (showing 51 of 111)

View all versions

Version	Deps	Published
2.8.0	10 / 9	2018-06-25
2.7.0	10 / 9	2018-06-10
2.6.0	9 / 7	2016-09-26
2.5.1	9 / 6	2015-02-06
2.5.0	9 / 6	2014-12-17
2.4.3	8 / 5	2014-12-12
2.4.2	8 / 5	2014-12-12
2.4.1	8 / 5	2014-01-10
2.4.0	8 / 5	2013-12-10
2.3.2	7 / 5	2013-11-01
2.3.1	7 / 5	2013-10-26
2.3.0	7 / 4	2013-07-12
2.2.0	7 / 4	2013-06-24
2.1.0	6 / 4	2013-05-25
2.0.5	6 / 4	2013-04-24
2.0.4	6 / 4	2013-04-06
2.0.3	6 / 4	2013-04-05
2.0.2	6 / 4	2013-04-05
2.0.1	6 / 4	2013-04-05
2.0.0	6 / 4	2013-04-05
1.18.0	8 / 3	2013-04-01
1.17.0	0 / 3	2013-03-27
1.16.13	0 / 3	2013-03-23
1.16.12	0 / 2	2013-03-19
1.16.11	0 / 2	2013-03-09
1.16.10	0 / 2	2013-03-07
1.16.9	0 / 2	2013-03-07
1.16.8	0 / 2	2013-02-15
1.16.7	0 / 2	2013-02-12
1.16.6	0 / 2	2013-02-12
1.16.5	0 / 2	2013-02-06
1.16.4	0 / 2	2013-02-06
1.16.3	0 / 2	2013-02-05
1.16.2	0 / 2	2013-02-01
1.16.1	0 / 2	2013-01-25
1.16.0	0 / 2	2013-01-24
1.15.4	0 / 2	2013-01-08
1.15.3	0 / 2	2012-12-24
1.15.2	0 / 2	2012-12-15
1.15.1	0 / 2	2012-12-15
1.15.0	0 / 2	2012-12-15
1.14.1	0 / 2	2012-12-14
1.14.0	0 / 2	2012-11-23
1.13.13	0 / 2	2012-10-27
1.13.12	0 / 2	2012-10-22
1.13.11	0 / 2	2012-10-21
1.13.10	0 / 2	2012-10-07
1.13.9	0 / 2	2012-10-07
1.13.8	0 / 2	2012-10-02
1.13.7	0 / 2	2012-09-24
1.13.6	0 / 2	2012-09-18

v2.8.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.7.0

2 findings

HIGH Publisher changed: balupton → bevryme (on 2018-06-10) provenance

This version was published by a different npm account than previous versions on 2018-06-10. This could indicate a legitimate maintainer transition or an account compromise.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.6.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.5.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.5.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.4.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.4.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.4.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.4.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.3.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.3.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.3.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.2.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.1.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.0.5

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.0.4

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.0.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.0.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.0.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.0.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.18.0

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.17.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.16.13

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.16.12

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.16.11

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.16.10

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.16.9

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.16.8

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.16.7

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.16.6

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.16.5

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.16.4

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.16.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.16.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.16.1

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.16.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.15.4

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.15.3

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.15.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.15.1

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.15.0

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.14.1

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.14.0

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.13.13

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.13.12

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.13.11

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.13.10

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.13.9

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.13.8

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.13.7

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.13.6

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.