nib — Greenflagged

Stylus mixins and utilities

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.

Maintainers

slangtjholowaychukichenlei

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
publish-pattern	new-deps-added	AI (publish-pattern): stylus is the core framework that nib is built upon; adding it as a runtime dep is expected and appropriate for this Stylus mixins library.	ai	2026/04/24
provenance	no-provenance	AI (provenance): Package was published in 2013, predating Sigstore provenance. No provenance is expected for packages of this era.	ai	2026/04/24
provenance	publisher-changed	AI (provenance): Publisher transition from tjholowaychuk to slang800 occurred in 2013 and is a well-documented historical maintainer handoff. slang800 has a strong track record (11 approved packages).	ai	2026/04/24
maintainer-change	maintainer-added	AI (maintainer-change): slang800 was added as maintainer in 2013 as part of a legitimate historical transition. No ongoing risk.	ai	2026/04/24
source-diff	net-exec-file:test/public/jquery.min.js	AI (source-diff): File is jQuery v1.5.2 (official, MIT/GPL licensed) added to test/public. Network calls and dynamic execution are expected jQuery behavior, not malware. Stable false positive for this package.	ai	2026/04/24
source-diff	source-size-tripled	AI (source-diff): Size increase is entirely attributable to adding jQuery v1.5.2 (86KB) to the test directory. Not indicative of injected payload.	ai	2026/04/24
semgrep	semgrep:new-function-constructor	AI (semgrep): new Function() is used in the bundled Jade template engine to compile templates — standard, documented behavior for a template engine. Stable false positive for this package.	ai	2026/04/24
semgrep	semgrep:dynamic-require	AI (semgrep): The dynamic require is simply reading package.json for the version string — a universally benign pattern. Not a real risk for this package.	ai	2026/04/23

Versions (showing 27 of 27)

Version	Deps	Published
1.2.0	0 / 6	2022-05-17
1.1.2	1 / 4	2016-08-05
1.1.0	1 / 4	2015-01-19
1.0.4	1 / 4	2014-09-29
1.0.3	1 / 4	2014-06-19
1.0.2	1 / 4	2014-01-06
1.0.1	1 / 4	2013-08-21
1.0.0	1 / 5	2013-08-15
0.9.2	1 / 5	2013-06-25
0.9.1	0 / 6	2013-01-04
0.9.0	0 / 6	2012-11-24
0.8.2	0 / 6	2012-08-28
0.8.1	0 / 6	2012-08-21
0.7.1	0 / 6	2012-08-17
0.7.0	0 / 6	2012-07-09
0.6.0	0 / 6	2012-07-05
0.5.0	0 / 6	2012-05-28
0.4.1	0 / 6	2012-04-15
0.4.0	0 / 6	2012-04-03
0.3.2	0 / 4	2012-01-09
0.3.1	0 / 4	2011-11-30
0.3.0	0 / 4	2011-11-17
0.2.0	0 / 4	2011-08-26
0.1.0	0 / 4	2011-08-04
0.0.8	0 / 4	2011-05-24
0.0.7	0 / 0	2011-04-25
0.0.6	0 / 0	2011-04-15

v1.2.0

2 findings

HIGH Publisher changed: tjholowaychuk → ichenlei (on 2022-05-17) provenance

This version was published by a different npm account than previous versions on 2022-05-17. This could indicate a legitimate maintainer transition or an account compromise.

LOW No provenance attestation provenance