es6-map — Greenflagged

ECMAScript6 Map polyfill

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.

Maintainers

medikoo

Keywords

collectiones6shimharmonylisthashmappolyfillponyfillecmascript

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
npm-metadata	url-dep:es5-ext	AI (npm-metadata): Git URL points to medikoo/es5-ext — same trusted author's own repo. Consistent with accepted url-dep pattern for this package's ecosystem.	ai	2026/04/24
npm-metadata	suspicious-initial-version	AI (npm-metadata): Package is 12+ years old with 1.4M weekly downloads; 0.0.0 reflects early development convention, not malicious intent. Stable false positive for this package.	ai	2026/04/24
npm-metadata	url-dep:d	AI (npm-metadata): Git URL points to medikoo/d — same trusted author's own repo. Early-era practice for coordinated polyfill development; no supply chain risk beyond the already-accepted url-dep findings.	ai	2026/04/24
npm-metadata	url-dep:event-emitter	AI (npm-metadata): Git URL points to medikoo/event-emitter — same trusted author's own repo. Consistent with accepted url-dep pattern for this package's ecosystem.	ai	2026/04/24
npm-metadata	url-dep:es6-iterator	AI (npm-metadata): URL dep points to the same author's (medikoo) own GitHub repo; consistent with early-stage publishing practice for this 12-year-old package.	ai	2026/04/24
npm-metadata	url-dep:es6-set	AI (npm-metadata): URL dep points to the same author's (medikoo) own GitHub repo; consistent with early-stage publishing practice for this 12-year-old package.	ai	2026/04/24
npm-metadata	url-dep:es6-symbol	AI (npm-metadata): URL dep points to the same author's (medikoo) own GitHub repo; consistent with early-stage publishing practice for this 12-year-old package.	ai	2026/04/24
publish-pattern	dormant-publish	AI (publish-pattern): medikoo is a long-standing trusted publisher; es6-map is a mature polyfill for a native JS feature requiring infrequent updates. Dormancy is expected, not suspicious.	ai	2026/04/23
phantom-deps	phantom-dep:es6-set	AI (phantom-deps): es6-set is a declared runtime dependency and sibling polyfill; referenced in config/test files is expected for this package family.	ai	2026/04/23