dot-access
Access object properties using dot notation.
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| maintainer-change | maintainer-takeover | AI (maintainer-change): Transition occurred in 2015, ~10 years ago. Publisher nthtran has 6 approved packages, repo URL matches their GitHub handle — consistent with a legitimate historical handoff. | ai | |
| maintainer-change | maintainer-added | AI (maintainer-change): Same 2015 transition; nthtran is the long-standing legitimate maintainer with a clean track record. | ai | |
| maintainer-change | maintainer-removed | AI (maintainer-change): Removal of ntran013 is part of the same decade-old legitimate handoff to nthtran. | ai | |
| provenance | publisher-changed | AI (provenance): Publisher change is from 2015; repo URL and publisher history confirm this is a legitimate historical transition, not a compromise. | ai | |
| semgrep | semgrep:new-function-constructor | AI (semgrep): new Function() is the core mechanism of this dot-access library for property path traversal — it is the intended functionality, not malicious code. | ai |
Versions (showing 6 of 6)
| Version | Deps | Published |
|---|---|---|
| 1.0.0 | 0 / 1 | |
| 0.0.5 | 0 / 1 | |
| 0.0.4 | 0 / 1 | |
| 0.0.3 | 0 / 1 | |
| 0.0.2 | 0 / 1 | |
| 0.0.1 | 0 / 1 |
v1.0.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.5
3 findingsAll previous maintainers (ntran013) were replaced by new maintainers (nthtran). This is a strong signal of a potential package hijack and requires careful review.
This version was published by a different npm account than previous versions on 2015-03-12. This could indicate a legitimate maintainer transition or an account compromise.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.4
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.3
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.0.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.