re2
Bindings for RE2: fast, safe alternative to backtracking regular expression engines.
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| npm-metadata | bundled-binaries | AI (npm-metadata): re2 is a native Node.js addon; bundled .o and .node files are the expected compiled output of the RE2 C++ library and its bindings. Stable pattern for this package. | ai | |
| source-diff | net-exec-file:tests/test_matchAll.js | AI (source-diff): The eval() calls are heya-unit's test assertion idiom (eval(t.TEST(...))); no actual network calls exist in this test file. This is a stable false positive for this package's test suite pattern. | ai | |
| license | uncommon-license:New BSD | AI (license): New BSD is a well-known permissive license; the uncommon flag is a false positive for this package. | ai | |
| semgrep | semgrep:child-process-import | AI (semgrep): child_process is used only in a dev/CI script (create-binary-asset.js) for packaging GitHub release binaries, not in runtime or install code. Expected for a native addon package. | ai | |
| publish-pattern | new-deps-added | AI (publish-pattern): install-artifact-from-github is a legitimate helper for fetching prebuilt native binaries from GitHub releases; consistent with re2's documented install flow for native bindings. | ai | |
| phantom-deps | phantom-dep:nan | AI (phantom-deps): nan is a standard native addon build dependency referenced in binding.gyp, not a runtime import. Expected for this package. | ai | |
| phantom-deps | phantom-dep:node-gyp | AI (phantom-deps): node-gyp is the standard build tool for native Node.js addons; its presence as an implicit dependency is expected for re2. | ai | |
| phantom-deps | phantom-dep:install-artifact-from-github | AI (phantom-deps): install-artifact-from-github is the prebuilt binary fetcher used in re2's install script — expected and stable for this package. | ai | |
| install-scripts | install-script:install | AI (install-scripts): re2 is a native Node.js addon; its install script fetches prebuilt binaries or builds via node-gyp — the canonical pattern for native bindings, stable across all versions. | ai |
Versions (showing 9 of 9)
| Version | Deps | Published |
|---|---|---|
| 1.20.8 | 3 / 3 | |
| 1.17.3 | 3 / 1 | |
| 1.16.0 | 3 / 1 | |
| 1.15.9 | 3 / 1 | |
| 1.15.8 | 3 / 1 | |
| 1.8.4 | 1 / 1 | |
| 1.5.0 | 1 / 1 | |
| 1.4.1 | 1 / 1 | |
| 0.9.0 | 1 / 1 |
v1.20.8
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.17.3
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.16.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.15.9
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.15.8
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.8.4
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.5.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.4.1
2 findingsPackage contains compiled binaries that could be backdoors: • build/Release/obj.target/re2/lib/replace.o • build/Release/obj.target/re2/lib/accessors.o • build/Release/obj.target/re2/lib/exec.o • build/Release/obj.target/re2/lib/match.o • build/Release/obj.target/re2/lib/new.o • build/Release/obj.target/re2/lib/addon.o • build/Release/obj.target/re2/lib/search.o • build/Release/obj.target/re2/lib/split.o • build/Release/obj.target/re2/lib/test.o • build/Release/obj.target/re2/lib/to_string.o ... and 26 more
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.9.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.