randexp
Create random strings that match a given regular expression.
20
Versions
MIT
License
No
Install Scripts
Missing
Provenance
Supply chain provenance
Status for the latest visible version.
No SLSA provenance
npm registry signatures
gitHead linked
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
fent
Keywords
regexregexpregular expressionrandomtest
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | source-size-dropped | AI (source-diff): Size drop explained by extraction of regex tokenizer into the 'ret' dependency (also by fent). Standard refactoring pattern, not a stub replacement. | ai | |
| provenance | publisher-changed | AI (provenance): Publisher change to fent in 2014 is legitimate — fent is the documented author in package.json with matching GitHub repo and homepage. 11-year-old transfer with clean track record. | ai | |
| maintainer-change | maintainer-added | AI (maintainer-change): fent is the documented author; addition is part of a legitimate 2014 ownership transfer. | ai | |
| maintainer-change | maintainer-removed | AI (maintainer-change): Removal of 'neat' is part of the same legitimate 2014 transfer to the documented author fent. | ai | |
| maintainer-change | maintainer-takeover | AI (maintainer-change): Transfer occurred in 2014 to fent (Roly Fentanes), the documented author of the package. Publisher has 29 approved packages and 0 rejected. Clearly a legitimate historical transition. | ai | |
| dependencies | unvetted-dep:drange | AI (dependencies): drange is a legitimate range utility replacing discontinuous-range; a natural fit for randexp's regex character range handling. No malicious signals. | ai | |
| publish-pattern | new-deps-added | AI (publish-pattern): drange replaces discontinuous-range as a cleaner range library; this is a routine dependency modernization by a trusted publisher with no suspicious signals. | ai | |
| provenance | no-provenance | AI (provenance): Established package published long before Sigstore provenance was available on npm; absence is expected and not a risk signal for this package. | ai |