secure-random — Greenflagged

Normalize the creation of cryptographically strong random values.

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.

Maintainers

jprichardson

Keywords

cryptocryptographysecurerandomrandgeneratornumber

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
maintainer-change	maintainer-takeover	AI (maintainer-change): jp and jprichardson are the same person (JP Richardson); the repo URL and author field both confirm jprichardson as the original author. This is an account consolidation, not a hostile takeover.	ai	2026/04/23
provenance	publisher-changed	AI (provenance): Publisher change from jp to jprichardson reflects the same author (JP Richardson) migrating to a new npm account matching their GitHub handle. Not a compromise.	ai	2026/04/23
maintainer-change	maintainer-added	AI (maintainer-change): jprichardson is the original author JP Richardson under a different npm account; addition is benign.	ai	2026/04/23
maintainer-change	maintainer-removed	AI (maintainer-change): Removal of jp account is part of the same author's account consolidation to jprichardson; not a hostile removal.	ai	2026/04/23

Versions (showing 8 of 8)

Version	Deps	Published
1.1.2	0 / 3	2019-05-22
1.1.1	0 / 3	2014-06-30
1.1.0	0 / 3	2014-06-30
1.0.0	0 / 3	2014-06-03
0.2.1	0 / 2	2014-03-20
0.2.0	0 / 2	2013-12-17
0.1.0	0 / 2	2013-12-08
0.0.1	0 / 2	2013-11-07

v1.1.2

3 findings

HIGH Complete maintainer takeover detected maintainer-change

All previous maintainers (jp) were replaced by new maintainers (jprichardson). This is a strong signal of a potential package hijack and requires careful review.

HIGH Publisher changed: jp → jprichardson (on 2019-05-22) provenance

This version was published by a different npm account than previous versions on 2019-05-22. This could indicate a legitimate maintainer transition or an account compromise.