string.prototype.matchall
Spec-compliant polyfill for String.prototype.matchAll
2
Versions
MIT
License
No
Install Scripts
Missing
Provenance
Supply chain provenance
Status for the latest visible version.
No SLSA provenance
npm registry signatures
gitHead linked
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
ljharb
Keywords
ES2020ESString.prototype.matchAllmatchAllmatchregexregexpregularexpressionmatches
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| dependencies | unvetted-dep:gopd | AI (dependencies): gopd is a standard es-shims ecosystem package maintained by ljharb; its use here is expected and legitimate. | ai | |
| dependencies | unvetted-dep:define-properties | AI (dependencies): define-properties is a core es-shims utility maintained by ljharb; standard dependency for this polyfill package. | ai | |
| dependencies | unvetted-dep:set-function-name | AI (dependencies): set-function-name is a standard es-shims utility maintained by ljharb; expected dependency for this polyfill. | ai | |
| phantom-deps | phantom-dep:side-channel | AI (phantom-deps): side-channel is a declared runtime dep in package.json used within the es-shims ecosystem; phantom signal is a false positive here. | ai | |
| phantom-deps | phantom-dep:internal-slot | AI (phantom-deps): internal-slot is a declared runtime dep in package.json used within the es-shims ecosystem; phantom signal is a false positive here. | ai |
v4.0.8
1 finding
LOW
No provenance attestation
provenance
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.