es6-set — Greenflagged

ECMAScript6 Set polyfill

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.

Maintainers

medikoo

Keywords

setcollectiones6harmonylisthash

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
npm-metadata	url-dep:event-emitter	AI (npm-metadata): Git URL points to medikoo's own repo; consistent with early-stage co-development by the same trusted author.	ai	2026/04/24
npm-metadata	suspicious-initial-version	AI (npm-metadata): es6-set is a legitimate, widely-downloaded polyfill by trusted publisher medikoo. Version 0.0.0 is an early snapshot, not a throwaway malicious package.	ai	2026/04/24
npm-metadata	url-dep:d	AI (npm-metadata): Git URL points to medikoo's own repo; consistent with early-stage co-development by the same trusted author.	ai	2026/04/24
npm-metadata	url-dep:es5-ext	AI (npm-metadata): Git URL points to medikoo's own repo; consistent with early-stage co-development by the same trusted author.	ai	2026/04/24
npm-metadata	url-dep:es6-iterator	AI (npm-metadata): Git URL points to medikoo's own repo; consistent with early-stage co-development by the same trusted author.	ai	2026/04/24
publish-pattern	new-deps-added	AI (publish-pattern): The new `type` dependency is authored by medikoo (same publisher as es6-set); not a third-party injection risk.	ai	2026/04/23
dependencies	unvetted-dep:d	AI (dependencies): `d` is a long-standing medikoo-authored dependency of this package, not a new or suspicious addition.	ai	2026/04/23
dependencies	unvetted-dep:event-emitter	AI (dependencies): `event-emitter` is a long-standing medikoo-authored dependency of this package, not a new or suspicious addition.	ai	2026/04/23
publish-pattern	dormant-publish	AI (publish-pattern): medikoo is a long-standing trusted publisher with 103 approved packages; dormancy followed by routine maintenance update is not indicative of account takeover for this author.	ai	2026/04/23