rcfinder — Greenflagged

Find a config file (like .jshintrc) by walking up from a specific directory.

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.

Maintainers

spalger

Keywords

findrcfilercsearchdefaultsconfig

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
semgrep	semgrep:dynamic-require	AI (semgrep): Dynamic require is the core design of rcfinder — it loads config files by path as part of its rc-file-finding functionality. Not a security risk in this context.	ai	2026/04/24
phantom-deps	phantom-dep:expect.js	AI (phantom-deps): expect.js is incorrectly listed in both dependencies and devDependencies; it's a test library packaging mistake, not a phantom dependency security issue.	ai	2026/04/24
maintainer-change	maintainer-added	AI (maintainer-change): spalger is the same person as spenceralger; account rename, not a new maintainer.	ai	2026/04/23
maintainer-change	maintainer-takeover	AI (maintainer-change): spenceralger → spalger is the same person (Spencer Alger) with a shortened npm handle; not a takeover.	ai	2026/04/23
publish-pattern	dormant-publish	AI (publish-pattern): Small stable utility; dormancy followed by lodash modularization update is expected.	ai	2026/04/23
maintainer-change	maintainer-removed	AI (maintainer-change): Old account name spenceralger replaced by spalger (same person).	ai	2026/04/23
provenance	publisher-changed	AI (provenance): Same author renamed npm account from spenceralger to spalger; legitimate transition.	ai	2026/04/23

Versions (showing 10 of 10)

Version	Deps	Published
0.1.9	1 / 2	2016-05-09
0.1.8	1 / 2	2014-07-07
0.1.7	1 / 2	2014-05-06
0.1.6	1 / 2	2014-03-31
0.1.5	1 / 2	2014-03-31
0.1.4	1 / 2	2014-02-18
0.1.3	0 / 2	2014-02-17
0.1.2	0 / 2	2014-02-17
0.1.1	0 / 2	2014-02-17
0.1.0	1 / 2	2014-02-17

v0.1.9

3 findings

HIGH Complete maintainer takeover detected maintainer-change

All previous maintainers (spenceralger) were replaced by new maintainers (spalger). This is a strong signal of a potential package hijack and requires careful review.

HIGH Publisher changed: spenceralger → spalger (on 2016-05-09) provenance

This version was published by a different npm account than previous versions on 2016-05-09. This could indicate a legitimate maintainer transition or an account compromise.