qw
Quoted word literals!
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| typosquat | typosquat.levenshtein:qs | AI (typosquat): qw is a distinct, established ~11-year-old package (quoted-word utility) with 94k weekly downloads. Not a typosquat of qs. | ai | |
| typosquat | typosquat.levenshtein:pg | AI (typosquat): qw is a distinct, established ~11-year-old package with 94k weekly downloads. Not a typosquat of pg. | ai | |
| bogus-package | bogus-package | AI (bogus-package): Minimal metadata is consistent with early-era npm publishing norms (~2012). 94k weekly downloads and 11+ year age confirm legitimate utility package. | ai | |
| maintainer-change | maintainer-takeover | AI (maintainer-change): Transfer to iarna (Rebecca Turner) in 2016 is a well-documented, legitimate handoff. iarna is a highly trusted npm publisher with 1188 approved packages and 4243 days of history. | ai | |
| maintainer-change | maintainer-removed | AI (maintainer-change): Removal of magemagic is part of the same legitimate 2016 transfer to iarna; no evidence of compromise. | ai | |
| provenance | publisher-changed | AI (provenance): Publisher change from magemagic to iarna occurred in 2016 and is a legitimate historical transfer. iarna is a well-established, trusted npm publisher. | ai | |
| maintainer-change | maintainer-added | AI (maintainer-change): iarna is a trusted, long-standing npm publisher; addition is part of a legitimate 2016 ownership transfer. | ai |
v1.0.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.0
3 findingsAll previous maintainers (magemagic) were replaced by new maintainers (iarna). This is a strong signal of a potential package hijack and requires careful review.
This version was published by a different npm account than previous versions on 2016-11-08. This could indicate a legitimate maintainer transition or an account compromise.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.1
2 findingsPackage name 'qw' is 1 edit(s) away from popular package 'qs'.
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.