fbemitter — Greenflagged

Facebook's EventEmitter is a simple emitter implementation that prioritizes speed and simplicity. It is conceptually similar to other emitters like Node's EventEmitter, but the precise APIs differ. More complex abstractions like the event systems used on

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.

Maintainers

yangshunzpaofb

Keywords

clientside

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
provenance	publisher-changed	AI (provenance): Publisher change from kyldvs to zpao occurred in Jan 2016 — a legitimate Facebook internal transition. zpao is a well-established Meta/Facebook engineer with strong track record.	ai	2026/04/24
maintainer-change	maintainer-added	AI (maintainer-change): fb and zpao are official Facebook/Meta npm accounts. This is a legitimate organizational maintainer setup, not a compromise.	ai	2026/04/24
bogus-package	bogus-package	AI (bogus-package): The spam-publisher flag on 'fb' and 'zpao' are legitimate Facebook/Meta npm org accounts, not spam. This is a stable false positive for this package.	ai	2026/04/23

Versions (showing 7 of 7)

Version	Deps	Published
3.0.0	1 / 9	2021-01-09
2.1.1	1 / 9	2016-09-03
2.1.0	1 / 9	2016-09-02
2.0.3	1 / 9	2016-09-02
2.0.2	1 / 9	2016-02-03
2.0.1	1 / 9	2016-01-03
2.0.0	1 / 8	2015-08-12

v3.0.0

2 findings

HIGH Publisher changed: zpao → yangshun (on 2021-01-09) provenance

This version was published by a different npm account than previous versions on 2021-01-09. This could indicate a legitimate maintainer transition or an account compromise.