gulp-uglify — Greenflagged

Minify files with UglifyJS.

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.

Maintainers

terinjokes

Keywords

gulpplugin

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
publish-pattern	new-deps-added	AI (publish-pattern): Dep swap is a documented gulp-util migration; all new deps are established packages with no malicious history.	ai	2026/05/27
phantom-deps	phantom-dep:prettier	AI (phantom-deps): Prettier is a dev formatting tool referenced in eslintConfig; not imported at runtime. Stable false positive for this package.	ai	2026/04/22
phantom-deps	phantom-dep:eslint-config-xo	AI (phantom-deps): ESLint config referenced only in eslintConfig section; not imported at runtime. Stable false positive for this package.	ai	2026/04/22
phantom-deps	phantom-dep:eslint-plugin-unicorn	AI (phantom-deps): ESLint plugin referenced only in eslintConfig section; not imported at runtime. Stable false positive for this package.	ai	2026/04/22
dependencies	unvetted-dep:eslint-config-xo	AI (dependencies): ESLint config package used for linting only; mistakenly placed in dependencies instead of devDependencies. Not a security risk for this package.	ai	2026/04/22
dependencies	unvetted-dep:eslint-plugin-unicorn	AI (dependencies): ESLint plugin used for linting only; mistakenly placed in dependencies instead of devDependencies. Not a security risk for this package.	ai	2026/04/22
dependencies	unvetted-dep:eslint-plugin-prettier	AI (dependencies): ESLint plugin used for linting only; mistakenly placed in dependencies instead of devDependencies. Not a security risk for this package.	ai	2026/04/22
phantom-deps	phantom-dep:eslint-plugin-no-use-extend-native	AI (phantom-deps): ESLint plugin referenced only in eslintConfig section; not imported at runtime. Stable false positive for this package.	ai	2026/04/22
phantom-deps	phantom-dep:eslint-plugin-prettier	AI (phantom-deps): ESLint plugin referenced only in eslintConfig section; not imported at runtime. Stable false positive for this package.	ai	2026/04/22
phantom-deps	phantom-dep:eslint-config-prettier	AI (phantom-deps): ESLint config referenced only in eslintConfig section; not imported at runtime. Stable false positive for this package.	ai	2026/04/22
phantom-deps	phantom-dep:eslint	AI (phantom-deps): ESLint is a dev linting tool referenced in eslintConfig; not imported at runtime. Stable false positive for this package.	ai	2026/04/22
dependencies	unvetted-dep:eslint-plugin-no-use-extend-native	AI (dependencies): ESLint plugin used for linting only; mistakenly placed in dependencies instead of devDependencies. Not a security risk for this package.	ai	2026/04/22
dependencies	unvetted-dep:array-each	AI (dependencies): array-each is a small, well-known utility package; no security concerns for this gulp plugin context.	ai	2026/04/22
dependencies	unvetted-dep:has-gulplog	AI (dependencies): has-gulplog is a standard Gulp ecosystem utility; no security concerns.	ai	2026/04/22
dependencies	unvetted-dep:extend-shallow	AI (dependencies): extend-shallow is a widely-used object merging utility; no security concerns for this package.	ai	2026/04/22
dependencies	unvetted-dep:vinyl-sourcemaps-apply	AI (dependencies): vinyl-sourcemaps-apply is a standard Gulp/Vinyl ecosystem package for sourcemap handling; no security concerns.	ai	2026/04/22
dependencies	unvetted-dep:uglify-save-license	AI (dependencies): uglify-save-license is a legitimate companion utility for preserving license comments during minification.	ai	2026/04/22
dependencies	unvetted-dep:make-error-cause	AI (dependencies): make-error-cause is a small, well-known error utility; no security concerns.	ai	2026/04/22
dependencies	unvetted-dep:uglify-js	AI (dependencies): uglify-js is the canonical JS minifier; core dependency of this package by design.	ai	2026/04/22
dependencies	unvetted-dep:gulplog	AI (dependencies): gulplog is a well-known Gulp ecosystem logging package; no security concerns.	ai	2026/04/22
provenance	no-provenance	AI (provenance): gulp-uglify predates Sigstore provenance by years; absence of attestation is expected for this package's age and publish history.	ai	2026/04/21