hamljs
Faster / Express compliant Haml implementation
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| bogus-package | bogus-package | AI (bogus-package): hamljs is a 15-year-old established HAML template engine by TJ Holowaychuk with 39k weekly downloads. The bogus-package signals are false positives for a package of this age and provenance. | ai | |
| source-diff | net-exec-file:spec/lib/jspec.js | AI (source-diff): jspec.js is the JSpec BDD testing framework by the same author (TJ Holowaychuk). XMLHttpRequest usage is for test runner HTTP requests; not malware. | ai | |
| source-diff | net-exec-file:benchmarks/haml-js/lib/haml.js | AI (source-diff): This is a competing HAML implementation included for benchmarking. eval/new Function are standard template engine patterns; no malicious network behavior. | ai | |
| semgrep | semgrep:eval-usage | AI (semgrep): eval() usage is in benchmark/spec files for a template engine. Template engines routinely compile and eval templates; this is expected and stable for hamljs. | ai | |
| source-diff | net-exec-file:haml.js | AI (source-diff): haml.js is a uRequire-generated AMD/UMD build artifact. The 'network' signal comes from AMD define() patterns and doctype URL strings, not actual network calls. new Function() is the standard HAML template compilation mechanism. | ai | |
| semgrep | semgrep:new-function-constructor | AI (semgrep): new Function() in hamljs is the canonical template compilation mechanism — compiles parsed HAML into JS functions. This is documented, expected behavior for a template engine. | ai |
Versions (showing 7 of 7)
| Version | Deps | Published |
|---|---|---|
| 0.6.2 | 0 / 4 | |
| 0.6.1 | 0 / 0 | |
| 0.6.0 | 0 / 0 | |
| 0.5.2 | 0 / 0 | |
| 0.5.1 | 0 / 0 | |
| 0.5.0 | 0 / 0 | |
| 0.4.5 | 0 / 0 |
v0.6.2
2 findingsNewly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.6.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.6.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.5.2
3 findingsNewly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.5.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.5.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.4.5
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.