js-yaml

YAML 1.2 parser and serializer

Supply chain provenance

Status for the latest visible version.

Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.

Maintainers

Keywords

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
provenance	no-provenance	AI (provenance): Provenance attestation is a best-practice recommendation; absence is not a security blocker for an established package.	ai	2026/04/21
source-diff	large-new-source-files	AI (source-diff): 29 new files correspond to expanded type system support and esprima integration; tracked in lib/ directory, not hidden bundles.	ai	2026/04/21
dependencies	unvetted-dep:esprima	AI (dependencies): esprima is an established, legitimate AST parser; appropriate for js-yaml's JavaScript function type support.	ai	2026/04/21
publish-pattern	dormant-publish	AI (publish-pattern): Long dormancy is a signal but not disqualifying for an established package; context shows legitimate maintenance activity.	ai	2026/04/21
publish-pattern	new-deps-added	AI (publish-pattern): New dependency (esprima) is semantically justified for JavaScript function parsing; not a suspicious injection pattern.	ai	2026/04/21
semgrep	semgrep:new-function-constructor	AI (semgrep): new Function() is appropriate for a YAML parser supporting JavaScript function serialization; input validated via AST inspection.	ai	2026/04/21

Version	Deps	Published
4.1.1	1 / 14	2025-11-12
3.14.2	2 / 9	2025-11-14