escodegen — Greenflagged

ECMAScript code generator

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.

Maintainers

michaelficarraconstellation

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
semgrep	semgrep:eval-usage	AI (semgrep): eval() in assets/json2.js is the canonical Crockford JSON polyfill pattern — a well-known, intentional use of eval for JSON parsing in legacy environments. Not a supply-chain risk.	ai	2026/04/22
semgrep	semgrep:new-function-constructor	AI (semgrep): new Function() usage is in jQuery test fixture files (tmp/jquery-1.7.2.js), not escodegen's own code. This is jQuery's JSON parsing pattern, not a risk for this package.	ai	2026/04/22
license	uncommon-license:BSD	AI (license): BSD is a standard permissive license; the analyzer doesn't recognize it by name but it is a well-known acceptable license.	ai	2026/04/22
source-diff	net-exec-file:tmp/res.js	AI (source-diff): tmp/res.js is a jQuery-based test output file. Network/exec patterns are jQuery's own code, not malicious dropper behavior.	ai	2026/04/22
source-diff	net-exec-file:tmp/c.js	AI (source-diff): tmp/c.js is a jQuery 1.7.2 test fixture used as input for escodegen's code generation tests. Network/exec patterns are jQuery's own AJAX code.	ai	2026/04/22
source-diff	net-exec-file:tmp/jquery-1.7.2.js	AI (source-diff): tmp/jquery-1.7.2.js is a jQuery 1.7.2 test fixture. Network/exec patterns are jQuery's own AJAX/JSON code, not malicious.	ai	2026/04/22
source-diff	net-exec-file:tmp/jquery.min.js	AI (source-diff): tmp/jquery.min.js is a minified jQuery 1.7.2 test fixture. Network/exec patterns are jQuery's own code, not malicious.	ai	2026/04/22
source-diff	obfuscated-file:tmp/res.js	AI (source-diff): tmp/res.js is a minified jQuery test fixture (escodegen output). Long lines are expected in minified JS test outputs.	ai	2026/04/22
source-diff	obfuscated-file:tmp/res2.js	AI (source-diff): tmp/res2.js is a minified jQuery test fixture output. Long lines are expected in minified JS test outputs.	ai	2026/04/22
source-diff	large-new-source-files	AI (source-diff): Large number of new files is expected for an early version of a code generator that bundles test fixtures (jQuery, esprima).	ai	2026/04/22
source-diff	net-exec-file:tmp/res2.js	AI (source-diff): tmp/res2.js is a jQuery-based test output file. Network/exec patterns are jQuery's own code, not malicious dropper behavior.	ai	2026/04/22
source-diff	obfuscated-file:esprima.js	AI (source-diff): esprima.js is the legitimate esprima parser (minified for distribution), with clear copyright headers. Not obfuscated malware.	ai	2026/04/22
source-diff	obfuscated-file:escodegen.browser.js	AI (source-diff): escodegen.browser.js is a browserify-generated bundle, explicitly documented in the build script. Long lines are expected in browserified output; not obfuscation.	ai	2026/04/22
publish-pattern	new-deps-added	AI (publish-pattern): estraverse is a legitimate, well-known AST traversal library from the same ecosystem author (Constellation), appropriate for an ECMAScript code generator.	ai	2026/04/22
source-diff	obfuscated-file:coverage/prettify.js	AI (source-diff): prettify.js is Google's syntax highlighter, minified as part of lcov HTML coverage report output. Not malicious — standard coverage tooling artifact.	ai	2026/04/22
source-diff	obfuscated-file:coverage/lcov-report/prettify.js	AI (source-diff): Same prettify.js minified file in lcov-report subdirectory. Standard coverage report artifact, not obfuscated malware.	ai	2026/04/22
source-diff	source-size-dropped	AI (source-diff): Size drop explained by removal of large files from prior version; new coverage artifacts are separate. No stub/redirect pattern present.	ai	2026/04/22
maintainer-change	maintainer-added	AI (maintainer-change): michaelficarra has a strong track record (49 approved packages) and is a recognized contributor to the JS AST tooling ecosystem.	ai	2026/04/22
provenance	publisher-changed	AI (provenance): michaelficarra is a well-known JS tooling maintainer; the transition from constellation (Yusuke Suzuki) is a documented legitimate handoff within the estools org.	ai	2026/04/22
semgrep	semgrep:dynamic-require	AI (semgrep): Dynamic require in bin/escodegen.js loads the package's own root module — standard CLI pattern, not arbitrary code loading.	ai	2026/04/21
provenance	no-provenance	AI (provenance): escodegen is a long-established, well-known package from a trusted publisher; lack of Sigstore provenance is common and not a meaningful risk signal here.	ai	2026/04/21

Versions (showing 51 of 60)

View all versions

Version	Deps	Published
2.1.0	4 / 12	2023-06-29
2.0.0	5 / 10	2020-08-05
1.14.3	5 / 9	2020-06-22
1.14.2	5 / 9	2020-06-03
1.14.1	5 / 9	2020-02-06
1.14.0	5 / 9	2020-02-06
1.13.0	5 / 9	2020-01-18
1.12.1	5 / 9	2020-01-03
1.12.0	5 / 9	2019-08-13
1.11.1	5 / 9	2019-02-19
1.11.0	5 / 9	2018-07-14
1.10.0	5 / 9	2018-06-11
1.9.1	5 / 9	2018-02-26
1.9.0	5 / 9	2017-09-08
1.8.1	5 / 9	2016-08-06
1.8.0	5 / 9	2016-01-03
1.7.1	5 / 9	2015-11-24
1.7.0	5 / 10	2015-09-06
1.6.1	5 / 10	2015-01-29
1.6.0	5 / 9	2015-01-12
1.5.0	5 / 9	2015-01-07
1.4.3	5 / 9	2014-12-19
1.4.2	5 / 9	2014-12-15
1.4.1	4 / 11	2014-09-04
1.4.0	4 / 11	2014-08-27
1.3.3	4 / 11	2014-05-31
1.3.2	4 / 11	2014-04-13
1.3.1	4 / 11	2014-04-03
1.3.0	4 / 11	2014-03-09
1.2.0	4 / 11	2014-02-07
1.1.0	4 / 10	2014-01-18
1.0.1	4 / 10	2013-12-07
1.0.0	3 / 10	2013-11-18
0.0.28	3 / 10	2013-11-01
0.0.27	3 / 10	2013-09-10
0.0.26	3 / 10	2013-08-18
0.0.25	3 / 10	2013-07-28
0.0.24	3 / 10	2013-07-11
0.0.23	3 / 5	2013-06-14
0.0.22	3 / 5	2013-04-24
0.0.21	3 / 5	2013-04-16
0.0.20	3 / 5	2013-04-01
0.0.19	3 / 5	2013-03-08
0.0.18	3 / 4	2013-03-08
0.0.17	3 / 2	2013-02-19
0.0.16	3 / 2	2013-02-06
0.0.15	2 / 1	2012-11-09
0.0.14	2 / 1	2012-11-06
0.0.12	2 / 0	2012-10-10
0.0.11	2 / 0	2012-10-09
0.0.10	2 / 0	2012-10-06

v0.0.28

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.27

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.26

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.25

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.24

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.22

2 findings

HIGH New obfuscated file: escodegen.browser.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.21

2 findings

HIGH New obfuscated file: escodegen.browser.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.20

2 findings

HIGH New obfuscated file: escodegen.browser.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.19

2 findings

HIGH New obfuscated file: escodegen.browser.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.18

2 findings

HIGH New obfuscated file: escodegen.browser.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.17

2 findings

HIGH New obfuscated file: escodegen.browser.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.16

2 findings

HIGH New obfuscated file: escodegen.browser.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.15

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.14

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.12

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.11

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.10

3 findings

HIGH New obfuscated file: coverage/prettify.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: coverage/lcov-report/prettify.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.