All url-regex versions

[email protected] rejected Risk: 63 MIT

url-regex @5.0.0

rejected
This version was rejected. It did not pass GreenFlagged's security review and is not served by the registry. The findings and risk dispositions below explain why.
npm Repository Homepage Tarball
63
Risk Score
MIT
License
No
Install Scripts
2
Dependencies
3
Dev Dependencies
2.3 KB
Package Size
Published

Regular expression for matching URLs

Maintainers

kevvasindresorhus

Keywords

regexstringurl

Dependencies (2)

PackageConstraintRegistry Status
tlds ^1.203.0 auto_approved
ip-regex ^4.1.0 auto_approved

Dev Dependencies (3)

PackageConstraintRegistry Status
xo ^0.24.0 No greenflagged match
ava ^1.4.1 auto_approved
tsd ^0.7.2 auto_approved

Transitive Dependency Tree

2 transitive deps max depth 1
  ├─ ip-regex ^4.1.0 → 4.3.0
  ├─ tlds ^1.203.0 → 1.261.0

Changes from v3.2.0

Dependency Changes

ChangePackageVersion
added tlds ^1.203.0
changed ip-regex ^1.0.1 → ^4.1.0

File Changes

1 added 0 removed 3 modified size delta: +1.7 KB

Risk Dispositions (1 applicable to this version, 0 other)

Accepted rules are downgraded to INFO on future analyses; rejected rules escalate to CRITICAL.

Rule Source Disposition Author Reason
osv:GHSA-v4rh-8p82-6h5w osv reject AI AI (osv): HIGH severity ReDoS (CVSS 7.5) affects all versions of url-regex including 5.0.0; no fix exists. Verdict generalizes to all versions.

SAST Findings (3)

HIGH Publisher changed: kevva → sindresorhus (on 2019-04-21) provenance

This version was published by a different npm account than previous versions on 2019-04-21. This could indicate a legitimate maintainer transition or an account compromise.

HIGH GHSA-v4rh-8p82-6h5w: Regular expression denial of service in url-regex osv

CVSS 7.5 (HIGH) — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H all versions of url-regex are vulnerable to Regular Expression Denial of Service. An attacker providing a very long string in String.test can cause a Denial of Service.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Review Summary

Risk score: 63. Findings: 2 high (+50), 1 medium (+10), 1 low (+3).

Commit: 9f0450b59906 Browse source

Published to npm: