regexpu
A source code transpiler that enables the use of ES2015 Unicode regular expressions in ES5.
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| provenance | publisher-changed | AI (provenance): Publisher change from mathias to google-wombot is a known legitimate transfer (Mathias Bynens → Google). Stable for this package. | ai | |
| publish-pattern | dormant-publish | AI (publish-pattern): Dormancy explained by maintainer transition to Google publishing infrastructure; stable for this package. | ai | |
| maintainer-change | maintainer-added | AI (maintainer-change): jridgewell and google-wombot are known Google-affiliated maintainers; legitimate organizational transfer. | ai | |
| npm-metadata | url-dep:esprima | AI (npm-metadata): The URL dep points to the author's own esprima fork on the same GitHub org, created to add ES6 regexp support before upstream support existed. Stable and expected for this package. | ai | |
| dependencies | unvetted-dep:jsesc | AI (dependencies): jsesc is a well-known, legitimate package by the same author (Mathias Bynens); its use here is expected and benign. | ai | |
| publish-pattern | new-deps-added | AI (publish-pattern): jsesc was already a devDependency; promotion to runtime dep is a natural, low-risk change by the same trusted author. | ai | |
| provenance | no-provenance | AI (provenance): regexpu is a long-established package (4257 days old); lack of Sigstore provenance is expected for packages of this vintage and is not a security risk here. | ai | |
| phantom-deps | phantom-dep:jsesc | AI (phantom-deps): jsesc is a legitimate runtime dependency by the same author; its indirect usage via config/build scripts is a known pattern for this package, not a security concern. | ai |
Versions (showing 48 of 48)
| Version | Deps | Published |
|---|---|---|
| 4.8.0 | 3 / 7 | |
| 4.6.0 | 3 / 7 | |
| 4.5.4 | 3 / 7 | |
| 4.5.3 | 3 / 7 | |
| 4.5.2 | 3 / 7 | |
| 4.5.1 | 3 / 7 | |
| 4.5.0 | 3 / 7 | |
| 4.4.0 | 3 / 7 | |
| 4.3.0 | 3 / 7 | |
| 4.2.0 | 3 / 7 | |
| 4.1.3 | 3 / 7 | |
| 4.1.2 | 3 / 7 | |
| 4.1.1 | 3 / 8 | |
| 4.1.0 | 3 / 8 | |
| 4.0.10 | 3 / 8 | |
| 4.0.9 | 3 / 8 | |
| 4.0.8 | 3 / 8 | |
| 4.0.7 | 3 / 8 | |
| 4.0.6 | 3 / 8 | |
| 4.0.5 | 3 / 8 | |
| 4.0.4 | 3 / 8 | |
| 4.0.3 | 3 / 7 | |
| 4.0.2 | 2 / 7 | |
| 4.0.1 | 2 / 7 | |
| 3.3.0 | 2 / 7 | |
| 3.2.0 | 2 / 8 | |
| 3.1.0 | 2 / 8 | |
| 3.0.1 | 2 / 8 | |
| 3.0.0 | 2 / 8 | |
| 2.1.0 | 2 / 6 | |
| 2.0.4 | 2 / 8 | |
| 2.0.3 | 5 / 8 | |
| 2.0.2 | 6 / 8 | |
| 2.0.1 | 6 / 8 | |
| 2.0.0 | 6 / 8 | |
| 1.3.0 | 5 / 7 | |
| 1.2.0 | 4 / 7 | |
| 1.1.2 | 4 / 7 | |
| 1.1.1 | 4 / 7 | |
| 1.1.0 | 4 / 7 | |
| 1.0.0 | 4 / 7 | |
| 0.3.1 | 4 / 7 | |
| 0.3.0 | 4 / 7 | |
| 0.2.3 | 4 / 7 | |
| 0.2.2 | 5 / 7 | |
| 0.2.1 | 5 / 6 | |
| 0.1.1 | 5 / 6 | |
| 0.1.0 | 5 / 4 |
v4.8.0
2 findingsThis version was published by a different npm account than previous versions on 2021-09-14. This could indicate a legitimate maintainer transition or an account compromise.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.6.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.5.4
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.5.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.5.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.5.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.5.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.4.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.3.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.2.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.1.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.1.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.1.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.0.10
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.0.8
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.0.7
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.0.6
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.0.5
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.0.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.