google-closure-compiler Apache-2.0 20 versions

google-closure-compiler

npm Repository Homepage

Check, compile, optimize and compress Javascript with Closure-Compiler

Versions

Apache-2.0

License

Install Scripts

Verified

Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures gitHead linked

chadhikesblicklylharker

javascriptcompileroptimizerminifierclosuregulpplugingruntplugin

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
phantom-deps	phantom-dep:chalk	AI (phantom-deps): chalk is a legitimate runtime dep used by the gulp plugin interface in this package; phantom-dep analyzer does not traverse all entry points in this ESM wrapper package.	ai	2026/04/23
phantom-deps	phantom-dep:vinyl	AI (phantom-deps): vinyl is a legitimate runtime dep for the gulp plugin interface; false positive due to incomplete source traversal by the analyzer.	ai	2026/04/23
phantom-deps	phantom-dep:vinyl-sourcemaps-apply	AI (phantom-deps): vinyl-sourcemaps-apply is a legitimate runtime dep for sourcemap support in the gulp plugin; false positive due to incomplete source traversal.	ai	2026/04/23
phantom-deps	phantom-dep:google-closure-compiler-java	AI (phantom-deps): google-closure-compiler-java is the sibling Java JAR package invoked via subprocess/path resolution, not direct import. This is the documented architecture of the closure-compiler-npm package family.	ai	2026/04/23
semgrep	semgrep:child-process-import	AI (semgrep): child_process use in contrib/nodejs/cluster.js is legitimate — this is a Node.js externs file for a compiler tool, not malicious code.	ai	2026/04/23