Summary
Togoder Security scanned the npm package regexp-tree@0.1.27 on Oct 6, 2026. An AI review of 44 source files produced no findings. No malicious behavior, install-time payloads, credential theft or exfiltration were identified.
0
critical
0
high
0
medium
0
low
Findings
No findings. The reviewer saw nothing malicious or risky in this version.
Files reviewed
| File | Verdict | What the reviewer saw |
|---|---|---|
| dist/bin/regexp-tree.js | safe | Cleared by Jev triage; no further analysis needed |
| dist/compat-transpiler/index.js | safe | Cleared by Jev triage; no further analysis needed |
| dist/compat-transpiler/runtime/index.js | safe | No malicious patterns detected; the code is a legitimate thin wrapper around RegExp with no network, filesystem, process, or dynamic code execution activities. |
| dist/compat-transpiler/transforms/compat-dotall-s-transform.js | safe | Cleared by Jev triage; no further analysis needed |
| dist/compat-transpiler/transforms/compat-named-capturing-groups-transform.js | safe | Cleared by Jev triage; no further analysis needed |
| dist/compat-transpiler/transforms/compat-x-flag-transform.js | safe | Cleared by Jev triage; no further analysis needed |
| dist/compat-transpiler/transforms/index.js | safe | Cleared by Jev triage; no further analysis needed |
| dist/generator/index.js | safe | Cleared by Jev triage; no further analysis needed |
| dist/interpreter/finite-automaton/dfa/dfa-minimizer.js | safe | No malicious patterns detected; the code is a legitimate DFA minimization implementation with no network, filesystem, process, or dynamic code execution activities. |
| dist/interpreter/finite-automaton/dfa/dfa.js | safe | No malicious patterns detected; the code is a standard transpiled DFA implementation with no network, filesystem, process, or dynamic execution activity. |
| dist/interpreter/finite-automaton/index.js | safe | Cleared by Jev triage; no further analysis needed |
| dist/interpreter/finite-automaton/nfa/builders.js | safe | No malicious patterns detected |
| dist/interpreter/finite-automaton/nfa/nfa-from-regexp.js | safe | No malicious patterns detected |
| dist/interpreter/finite-automaton/nfa/nfa-state.js | safe | No malicious patterns detected; the code is a standard NFA state implementation with no network, filesystem, process, or dynamic code execution activity. |
| dist/interpreter/finite-automaton/nfa/nfa.js | safe | No malicious patterns detected; the code is a standard NFA implementation for a regular expression engine. |
| dist/interpreter/finite-automaton/special-symbols.js | safe | Cleared by Jev triage; no further analysis needed |
| dist/interpreter/finite-automaton/state.js | safe | No malicious patterns detected |
| dist/optimizer/index.js | safe | Cleared by Jev triage; no further analysis needed |
| dist/optimizer/transforms/char-case-insensitive-lowercase-transform.js | safe | Cleared by Jev triage; no further analysis needed |
| dist/optimizer/transforms/char-class-classranges-merge-transform.js | safe | Cleared by Jev triage; no further analysis needed |
| dist/optimizer/transforms/char-class-classranges-to-chars-transform.js | safe | Cleared by Jev triage; no further analysis needed |
| dist/optimizer/transforms/char-class-remove-duplicates-transform.js | safe | Cleared by Jev triage; no further analysis needed |
| dist/optimizer/transforms/char-class-to-meta-transform.js | safe | No malicious patterns detected; the file is a benign regexp-tree AST transform plugin that only manipulates regular expression character classes. |
| dist/optimizer/transforms/char-class-to-single-char-transform.js | safe | Cleared by Jev triage; no further analysis needed |
| dist/optimizer/transforms/char-code-to-simple-char-transform.js | safe | Cleared by Jev triage; no further analysis needed |
Show 19 more files
| File | Verdict | What the reviewer saw |
|---|---|---|
| dist/optimizer/transforms/char-escape-unescape-transform.js | safe | Cleared by Jev triage; no further analysis needed |
| dist/optimizer/transforms/char-surrogate-pair-to-single-unicode-transform.js | safe | Cleared by Jev triage; no further analysis needed |
| dist/optimizer/transforms/combine-repeating-patterns-transform.js | safe | This is a benign regex optimization transform that only manipulates AST nodes for combining repeating patterns; no network, filesystem, process, credential, or dynamic execution behavior is present. |
| dist/optimizer/transforms/disjunction-remove-duplicates-transform.js | safe | Cleared by Jev triage; no further analysis needed |
| dist/optimizer/transforms/group-single-chars-to-char-class.js | safe | Cleared by Jev triage; no further analysis needed |
| dist/optimizer/transforms/index.js | safe | Cleared by Jev triage; no further analysis needed |
| dist/optimizer/transforms/quantifier-range-to-symbol-transform.js | safe | Cleared by Jev triage; no further analysis needed |
| dist/optimizer/transforms/quantifiers-merge-transform.js | safe | Cleared by Jev triage; no further analysis needed |
| dist/optimizer/transforms/remove-empty-group-transform.js | safe | Cleared by Jev triage; no further analysis needed |
| dist/optimizer/transforms/ungroup-transform.js | safe | No malicious patterns detected; the code is a benign regexp AST transform plugin with no network, filesystem, process, or dynamic execution behavior. |
| dist/parser/index.js | safe | No malicious patterns detected; the file simply wraps a generated parser and sets default options. |
| dist/parser/unicode/parser-unicode-properties.js | safe | No malicious patterns detected; the code is a pure data mapping utility for Unicode property aliases with no network, filesystem, process, or dynamic execution behavior. |
| dist/regexp-tree.js | safe | Cleared by Jev triage; no further analysis needed |
| dist/transform/index.js | safe | No malicious patterns detected; the code appears to be a legitimate AST transform utility for regular expressions without any security concerns. |
| dist/transform/utils.js | safe | No malicious patterns detected |
| dist/traverse/index.js | safe | This is a standard AST traversal utility with no malicious patterns, network access, or credential harvesting. |
| dist/traverse/node-path.js | safe | No malicious patterns detected; the code is a standard AST NodePath utility with no network, filesystem, process, or dynamic code execution behavior. |
| dist/utils/clone.js | safe | Cleared by Jev triage; no further analysis needed |
| index.js | safe | Cleared by Jev triage; no further analysis needed |
Scanned versions of regexp-tree
| Version | Verdict | Files | Scanned |
|---|---|---|---|
| 0.1.27 | No issues | 44 | Oct 6, 2026 |
Frequently asked questions
Is regexp-tree safe to use?
Our AI source review of regexp-tree@0.1.27 found no malicious code: no install-time payloads, credential theft, exfiltration, obfuscated loaders or backdoors.
Does regexp-tree contain malware?
No malware was identified in regexp-tree@0.1.27 when Togoder Security scanned it on Oct 6, 2026. A new version can still introduce malicious code, so scan the exact versions in your lockfile.
How was regexp-tree checked?
Togoder Security downloaded the published npm package and had an AI model read its 44 source files, looking for install scripts, credential access, network exfiltration, obfuscation, backdoors and crypto-wallet theft. The results are cached by file hash and shown here.
How do I scan regexp-tree together with the rest of my dependencies?
Upload your lockfile at https://security.togoder.click/scan or call the API documented at https://security.togoder.click/api-docs. Files that have already been scanned, like the ones in regexp-tree@0.1.27, cost nothing.