gulp-replace — Greenflagged

A string replace plugin for gulp

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.

Maintainers

lazd

Keywords

gulppluginreplace

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
publish-pattern	new-deps-added	AI (publish-pattern): @types/node and @types/vinyl are TypeScript type declaration packages with no executable code; their addition reflects TypeScript support being added to this package, not a supply-chain risk.	ai	2026/04/22
dependencies	unvetted-dep:@types/node	AI (dependencies): @types/node is a standard TypeScript type package; benign for a plugin with TypeScript support.	ai	2026/04/21
dependencies	unvetted-dep:@types/vinyl	AI (dependencies): @types/vinyl provides TypeScript types for gulp's vinyl file objects; expected for a typed gulp plugin.	ai	2026/04/21
phantom-deps	phantom-dep:@types/node	AI (phantom-deps): Type declaration packages are commonly declared without direct imports; this is a known TypeScript ecosystem pattern.	ai	2026/04/21
dependencies	unvetted-dep:istextorbinary	AI (dependencies): istextorbinary is a well-known utility for detecting file types; appropriate and expected for a gulp stream plugin.	ai	2026/04/21
dependencies	unvetted-dep:replacestream	AI (dependencies): replacestream is the core library this plugin wraps; its use is essential and expected.	ai	2026/04/21
phantom-deps	phantom-dep:yargs-parser	AI (phantom-deps): Phantom dependency is a minor hygiene issue; yargs-parser is declared and available, no security impact.	ai	2026/04/21
phantom-deps	phantom-dep:@types/vinyl	AI (phantom-deps): Type declaration packages are commonly declared without direct imports; this is a known TypeScript ecosystem pattern.	ai	2026/04/21

Versions (showing 17 of 17)

Version	Deps	Published
1.1.4	5 / 7	2022-12-17
1.1.3	5 / 7	2021-05-06
1.1.2	5 / 7	2021-04-28
1.1.1	3 / 4	2021-04-23
1.1.0	3 / 4	2021-04-22
1.0.0	3 / 4	2018-05-16
0.6.1	3 / 4	2017-06-20
0.6.0	3 / 4	2017-06-20
0.5.4	3 / 4	2015-08-05
0.5.3	3 / 4	2015-02-18
0.5.2	3 / 3	2015-01-21
0.5.1	3 / 3	2015-01-15
0.5.0	3 / 3	2014-11-05
0.4.0	3 / 3	2014-07-07
0.3.0	2 / 3	2014-05-06
0.2.0	2 / 3	2013-12-12
0.1.0	1 / 3	2013-12-11