readdirp — Greenflagged

Recursive version of fs.readdir with small RAM & CPU footprint

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures gitHead linked

paulmillrthlorenz

recursivefsstreamstreamsreaddirfilesystemfindfilter

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
provenance	publisher-changed	AI (provenance): Package legitimately transferred to paulmillr (Paul Miller), a well-known OSS developer. SLSA provenance attestation confirms CI/CD publish integrity. Repository URL updated to paulmillr/readdirp consistently.	ai	2026/04/21
maintainer-change	maintainer-added	AI (maintainer-change): paulmillr is a reputable, well-known OSS developer. This is a documented legitimate transfer of the readdirp package.	ai	2026/04/21
source-diff	source-size-dropped	AI (source-diff): Size drop from 131KB to 13KB reflects a TypeScript ESM rewrite with no runtime deps — a legitimate simplification, not a stub/redirect.	ai	2026/04/21
publish-pattern	dormant-publish	AI (publish-pattern): Dormancy followed by a major version rewrite is consistent with a maintainer transition, not account takeover. SLSA provenance further confirms legitimacy.	ai	2026/04/21
provenance	no-provenance	AI (provenance): Package is over 5000 days old; lack of Sigstore provenance is expected for packages predating that infrastructure.	ai	2026/04/21
dependencies	unvetted-dep:minimatch	AI (dependencies): minimatch is a well-known, widely-used glob library; its use as a dependency in a directory-reading utility is entirely expected and benign.	ai	2026/04/21
dependencies	unvetted-dep:set-immediate-shim	AI (dependencies): set-immediate-shim is a tiny, stable setImmediate polyfill with no security concerns; safe for this package across versions.	ai	2026/04/21