uuid
RFC9562 UUIDs
Supply chain provenance
Status for the latest visible version.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | obfuscated-file:dist/esm-browser/sha1.js | AI (source-diff): Readable SHA-1 implementation for uuid v5; long lines from unrolled hash rounds, not obfuscation. Stable for this package. | ai | |
| source-diff | obfuscated-file:dist/esm-browser/md5.js | AI (source-diff): Readable MD5 implementation for uuid v3; long lines from unrolled hash rounds, not obfuscation. Stable for this package. | ai | |
| install-scripts | install-script:preinstall | AI (install-scripts): Preinstall script is the documented build flow for native libuuid bindings; stable for this package. | ai | |
| source-diff | obfuscated-file:dist/esm/test/test_constants.js | AI (source-diff): Same test constants file in ESM dist format; readable UUID test vectors, not obfuscated. | ai | |
| source-diff | obfuscated-file:dist/esm-browser/test/test_constants.js | AI (source-diff): Test constants file containing UUID test vectors with long lines; clearly readable, not obfuscated. Standard for uuid's dist output. | ai | |
| source-diff | obfuscated-file:dist/cjs-browser/sha1.js | AI (source-diff): Readable TypeScript-compiled SHA1 implementation in CJS browser dist; long lines from algorithm constants, not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/esm-browser/test/parse.test.js | AI (source-diff): ESM browser dist test file; readable code, long lines from test data, not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/esm/test/parse.test.js | AI (source-diff): ESM dist test file; readable code, long lines from test data, not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/cjs-browser/test/test_constants.js | AI (source-diff): Test constants file with long lines of UUID test vectors; clearly readable, not obfuscated. | ai | |
| source-diff | obfuscated-file:dist/cjs/test/test_constants.js | AI (source-diff): Test constants file with long lines of UUID test vectors; clearly readable, not obfuscated. | ai | |
| source-diff | source-size-tripled | AI (source-diff): Size increase from shipping 4 dist variants (cjs/esm × node/browser) plus tests; expected for multi-target build. | ai | |
| source-diff | obfuscated-file:dist/cjs-browser/md5.js | AI (source-diff): Readable TypeScript-compiled MD5 implementation in CJS browser dist; long lines from algorithm constants, not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/cjs-browser/test/parse.test.js | AI (source-diff): Compiled test file with standard assert/node:test calls; long lines from test data arrays, not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/cjs/test/parse.test.js | AI (source-diff): Compiled test file with standard assert/node:test calls; long lines from test data arrays, not obfuscation. | ai | |
| provenance | no-provenance | AI (provenance): uuid is a 5500-day-old package with 241M weekly downloads published well before Sigstore provenance was available on npm. Absence is expected and not a risk signal. | ai | |
| semgrep | semgrep:child-process-import | AI (semgrep): child_process usage is confined to misc/compare.js, a private benchmark script comparing UUID libraries. Not runtime code; no install script invokes it. Safe for this package. | ai | |
| source-diff | large-new-source-files | AI (source-diff): Major version jump (v9→v13) with TypeScript migration naturally produces many new compiled output files. | ai | |
| provenance | publisher-changed | AI (provenance): broofa is a co-author of uuid (listed in funding); rotation from ctavan to broofa is between known maintainers. | ai | |
| maintainer-change | maintainer-removed | AI (maintainer-change): Removal of inactive maintainers (vvo, defunctzombie) during major version bump is routine cleanup. | ai |
Versions (showing 42 of 42)
| Version | Deps | Published |
|---|---|---|
| 14.0.0 | 0 / 15 | |
| 13.0.2 | 0 / 21 | |
| 13.0.1 | 0 / 21 | |
| 13.0.0 | 0 / 21 | |
| 12.0.0 | 0 / 21 | |
| 11.1.0 | 0 / 22 | |
| 11.0.5 | 0 / 22 | |
| 11.0.4 | 0 / 22 | |
| 11.0.3 | 0 / 22 | |
| 11.0.2 | 0 / 22 | |
| 11.0.1 | 0 / 22 | |
| 11.0.0 | 0 / 22 | |
| 10.0.0 | 0 / 27 | |
| 9.0.1 | 0 / 23 | |
| 9.0.0 | 0 / 23 | |
| 8.3.2 | 0 / 27 | |
| 8.3.1 | 0 / 27 | |
| 8.3.0 | 0 / 33 | |
| 8.2.0 | 0 / 32 | |
| 8.1.0 | 0 / 32 | |
| 8.0.0 | 0 / 27 | |
| 7.0.3 | 0 / 28 | |
| 7.0.2 | 0 / 25 | |
| 7.0.1 | 0 / 25 | |
| 7.0.0 | 0 / 24 | |
| 3.4.0 | 0 / 7 | |
| 3.3.3 | 0 / 7 | |
| 3.3.2 | 0 / 7 | |
| 3.3.0 | 0 / 7 | |
| 3.2.1 | 0 / 4 | |
| 3.2.0 | 0 / 4 | |
| 3.1.0 | 0 / 1 | |
| 3.0.1 | 0 / 1 | |
| 3.0.0 | 0 / 1 | |
| 2.0.3 | 0 / 1 | |
| 2.0.2 | 0 / 1 | |
| 2.0.1 | 0 / 1 | |
| 2.0.0 | 0 / 1 | |
| 1.4.2 | 0 / 1 | |
| 1.4.1 | 0 / 1 | |
| 1.4.0 | 0 / 0 | |
| 0.0.2 | 0 / 0 |
v13.0.2
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v13.0.1
2 findingsThis version was published without provenance, but prior versions were published via CI/CD with attestations. This is a strong signal of a potential account compromise or unauthorized publish. The axios attack (March 2026) exhibited exactly this pattern.
This version was published by a different npm account (broofa) than the most recent previously approved version (GitHub Actions) on 2026-04-29, but broofa is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v8.0.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.3.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.1.0
2 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2017-06-16. This could indicate a legitimate maintainer transition or an account compromise.