cookie

HTTP server cookie parsing and serialization

Supply chain provenance

Status for the latest visible version.

Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.

Maintainers

Keywords

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
npm-metadata	suspicious-initial-version	AI (npm-metadata): [email protected] is the genuine initial release of a well-established legitimate package by its original author; 0.0.0 is not indicative of malice here.	ai	2026/04/22
maintainer-change	maintainer-takeover	AI (maintainer-change): Legitimate transfer to jshttp org maintainers (dougwilson, blakeembrey); both are well-known, trusted npm ecosystem contributors. Not a hijack.	ai	2026/04/21
provenance	publisher-changed	AI (provenance): Publisher change reflects documented jshttp org maintainer transition; blakeembrey and dougwilson are established, trusted contributors.	ai	2026/04/21
maintainer-change	maintainer-added	AI (maintainer-change): New maintainers are well-known jshttp/Express ecosystem contributors; addition is part of a legitimate org transfer.	ai	2026/04/21
maintainer-change	maintainer-removed	AI (maintainer-change): Original maintainer shtylman stepped down as part of a known, legitimate handoff to jshttp org maintainers.	ai	2026/04/21
source-diff	source-size-tripled	AI (source-diff): Size increase reflects legitimate feature additions (new cookie options, validation logic) in 0.7.x; no obfuscation or bundled payloads detected.	ai	2026/04/21

Version	Deps	Published
1.1.1	0 / 5	2025-11-26
1.1.0	0 / 5	2025-11-25
1.0.2	0 / 5	2024-11-20
1.0.1	0 / 5	2024-10-11
1.0.0	0 / 5	2024-10-08
0.7.2	0 / 8	2024-10-07
0.7.1	0 / 8	2024-10-03
0.7.0	0 / 8	2024-10-02