trim-off-newlines — Greenflagged

Similar to String#trim() but removes only newlines

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.

Maintainers

stevemaotrott

Keywords

trimnewlinesnew-linesnewlinenew-linesstringstrutilutilsutilitywhitespacespaceremovedelete

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
provenance	publisher-changed	AI (provenance): Transition from stevemao to trott appears to be a legitimate maintainer handoff. trott is an established npm publisher with a strong track record and no code changes accompanied the transfer.	ai	2026/04/23
maintainer-change	maintainer-added	AI (maintainer-change): trott is an established npm account (first seen ~1995 days ago, 7 approved packages). Addition is consistent with a legitimate maintainer transfer, not a compromise.	ai	2026/04/23

Versions (showing 4 of 4)

Version	Deps	Published
1.0.3	0 / 2	2021-10-24
1.0.2	0 / 2	2021-09-17
1.0.1	0 / 2	2016-07-18
1.0.0	0 / 2	2015-09-18

v1.0.3

2 findings

HIGH Publisher changed: stevemao → trott (on 2021-10-24) provenance

This version was published by a different npm account than previous versions on 2021-10-24. This could indicate a legitimate maintainer transition or an account compromise.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.0.2

2 findings

MEDIUM GHSA-38fc-wpqx-33j7: Uncontrolled Resource Consumption in trim-off-newlines osv

CVSS 5.3 (MEDIUM) — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L All versions of package trim-off-newlines are vulnerable to Regular Expression Denial of Service (ReDoS) via string processing.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.0.1

2 findings

MEDIUM GHSA-38fc-wpqx-33j7: Uncontrolled Resource Consumption in trim-off-newlines osv

CVSS 5.3 (MEDIUM) — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L All versions of package trim-off-newlines are vulnerable to Regular Expression Denial of Service (ReDoS) via string processing.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.0.0

2 findings

MEDIUM GHSA-38fc-wpqx-33j7: Uncontrolled Resource Consumption in trim-off-newlines osv

CVSS 5.3 (MEDIUM) — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L All versions of package trim-off-newlines are vulnerable to Regular Expression Denial of Service (ReDoS) via string processing.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.