defs
Static scope analysis and transpilation of ES6 block scoped const and let variables, to ES3.
18
Versions
MIT
License
No
Install Scripts
Missing
Provenance
Supply chain provenance
Status for the latest visible version.
No SLSA provenance
npm registry signatures
No source commit
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
olov
Keywords
defsscopeblockscopeblock-scopeletconstvares6transpiletranspilerlintlinter
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| dependencies | unvetted-dep:ast-traverse | AI (dependencies): AST traversal utility; stable dependency of this transpiler package, consistent across versions, no security signals. | ai | |
| dependencies | unvetted-dep:simple-is | AI (dependencies): Stable dependency of this established transpiler package; consistent across versions, no security signals. | ai | |
| dependencies | unvetted-dep:stringmap | AI (dependencies): Stable dependency of this established transpiler package; consistent across versions, no security signals. | ai | |
| dependencies | unvetted-dep:stringset | AI (dependencies): Stable dependency of this established transpiler package; consistent across versions, no security signals. | ai | |
| dependencies | unvetted-dep:simple-fmt | AI (dependencies): Stable dependency of this established transpiler package; consistent across versions, no security signals. | ai | |
| dependencies | unvetted-dep:alter | AI (dependencies): Stable dependency of this established transpiler package; consistent across versions, no security signals. | ai | |
| dependencies | unvetted-dep:tryor | AI (dependencies): Stable dependency of this established transpiler package; consistent across versions, no security signals. | ai | |
| dependencies | unvetted-dep:yargs | AI (dependencies): Well-known CLI argument parser; stable dependency of this package across many versions. | ai | |
| dependencies | unvetted-dep:breakable | AI (dependencies): Stable dependency of this established transpiler package; consistent across versions, no security signals. | ai | |
| npm-metadata | url-dep:esprima | AI (npm-metadata): Historical git URL dependency on ariya/esprima#harmony is a well-known early ES6 tooling pattern from ~2013; the canonical repo is legitimate and this is stable across all versions of this package. | ai | |
| dependencies | unvetted-dep:esprima-fb | AI (dependencies): esprima-fb is Facebook's harmony-enabled fork of esprima, appropriate for an ES6 transpiler. The unusual version string is a known quirk of this fork's versioning, not a risk indicator. | ai | |
| provenance | no-provenance | AI (provenance): Package is 4746 days old; provenance attestation was not available at the time of initial publishing. Low signal for a package of this age and track record. | ai | |
| semgrep | semgrep:child-process-import | AI (semgrep): child_process is used in test harness (run-tests.js) to execute test commands; legitimate for a transpiler's test suite. | ai |