# regexp-tree@0.1.27 security report (npm)

- Verdict: **No issues** (risk level: safe)
- Scanned: 2026-10-06T14:24:21.000Z
- Files reviewed: 44
- Findings: no findings
- Report: https://security.togoder.click/npm/regexp-tree
- Source: Togoder Security (https://security.togoder.click), AI source-code review

## Summary

Togoder Security scanned the npm package regexp-tree@0.1.27 on Oct 6, 2026. An AI review of 44 source files produced no findings. No malicious behavior, install-time payloads, credential theft or exfiltration were identified.

## Findings

No findings.

## Files reviewed

- `dist/bin/regexp-tree.js` (safe): Cleared by Jev triage; no further analysis needed
- `dist/compat-transpiler/index.js` (safe): Cleared by Jev triage; no further analysis needed
- `dist/compat-transpiler/runtime/index.js` (safe): No malicious patterns detected; the code is a legitimate thin wrapper around RegExp with no network, filesystem, process, or dynamic code execution activities.
- `dist/compat-transpiler/transforms/compat-dotall-s-transform.js` (safe): Cleared by Jev triage; no further analysis needed
- `dist/compat-transpiler/transforms/compat-named-capturing-groups-transform.js` (safe): Cleared by Jev triage; no further analysis needed
- `dist/compat-transpiler/transforms/compat-x-flag-transform.js` (safe): Cleared by Jev triage; no further analysis needed
- `dist/compat-transpiler/transforms/index.js` (safe): Cleared by Jev triage; no further analysis needed
- `dist/generator/index.js` (safe): Cleared by Jev triage; no further analysis needed
- `dist/interpreter/finite-automaton/dfa/dfa-minimizer.js` (safe): No malicious patterns detected; the code is a legitimate DFA minimization implementation with no network, filesystem, process, or dynamic code execution activities.
- `dist/interpreter/finite-automaton/dfa/dfa.js` (safe): No malicious patterns detected; the code is a standard transpiled DFA implementation with no network, filesystem, process, or dynamic execution activity.
- `dist/interpreter/finite-automaton/index.js` (safe): Cleared by Jev triage; no further analysis needed
- `dist/interpreter/finite-automaton/nfa/builders.js` (safe): No malicious patterns detected
- `dist/interpreter/finite-automaton/nfa/nfa-from-regexp.js` (safe): No malicious patterns detected
- `dist/interpreter/finite-automaton/nfa/nfa-state.js` (safe): No malicious patterns detected; the code is a standard NFA state implementation with no network, filesystem, process, or dynamic code execution activity.
- `dist/interpreter/finite-automaton/nfa/nfa.js` (safe): No malicious patterns detected; the code is a standard NFA implementation for a regular expression engine.
- `dist/interpreter/finite-automaton/special-symbols.js` (safe): Cleared by Jev triage; no further analysis needed
- `dist/interpreter/finite-automaton/state.js` (safe): No malicious patterns detected
- `dist/optimizer/index.js` (safe): Cleared by Jev triage; no further analysis needed
- `dist/optimizer/transforms/char-case-insensitive-lowercase-transform.js` (safe): Cleared by Jev triage; no further analysis needed
- `dist/optimizer/transforms/char-class-classranges-merge-transform.js` (safe): Cleared by Jev triage; no further analysis needed
- `dist/optimizer/transforms/char-class-classranges-to-chars-transform.js` (safe): Cleared by Jev triage; no further analysis needed
- `dist/optimizer/transforms/char-class-remove-duplicates-transform.js` (safe): Cleared by Jev triage; no further analysis needed
- `dist/optimizer/transforms/char-class-to-meta-transform.js` (safe): No malicious patterns detected; the file is a benign regexp-tree AST transform plugin that only manipulates regular expression character classes.
- `dist/optimizer/transforms/char-class-to-single-char-transform.js` (safe): Cleared by Jev triage; no further analysis needed
- `dist/optimizer/transforms/char-code-to-simple-char-transform.js` (safe): Cleared by Jev triage; no further analysis needed
- `dist/optimizer/transforms/char-escape-unescape-transform.js` (safe): Cleared by Jev triage; no further analysis needed
- `dist/optimizer/transforms/char-surrogate-pair-to-single-unicode-transform.js` (safe): Cleared by Jev triage; no further analysis needed
- `dist/optimizer/transforms/combine-repeating-patterns-transform.js` (safe): This is a benign regex optimization transform that only manipulates AST nodes for combining repeating patterns; no network, filesystem, process, credential, or dynamic execution behavior is present.
- `dist/optimizer/transforms/disjunction-remove-duplicates-transform.js` (safe): Cleared by Jev triage; no further analysis needed
- `dist/optimizer/transforms/group-single-chars-to-char-class.js` (safe): Cleared by Jev triage; no further analysis needed
- `dist/optimizer/transforms/index.js` (safe): Cleared by Jev triage; no further analysis needed
- `dist/optimizer/transforms/quantifier-range-to-symbol-transform.js` (safe): Cleared by Jev triage; no further analysis needed
- `dist/optimizer/transforms/quantifiers-merge-transform.js` (safe): Cleared by Jev triage; no further analysis needed
- `dist/optimizer/transforms/remove-empty-group-transform.js` (safe): Cleared by Jev triage; no further analysis needed
- `dist/optimizer/transforms/ungroup-transform.js` (safe): No malicious patterns detected; the code is a benign regexp AST transform plugin with no network, filesystem, process, or dynamic execution behavior.
- `dist/parser/index.js` (safe): No malicious patterns detected; the file simply wraps a generated parser and sets default options.
- `dist/parser/unicode/parser-unicode-properties.js` (safe): No malicious patterns detected; the code is a pure data mapping utility for Unicode property aliases with no network, filesystem, process, or dynamic execution behavior.
- `dist/regexp-tree.js` (safe): Cleared by Jev triage; no further analysis needed
- `dist/transform/index.js` (safe): No malicious patterns detected; the code appears to be a legitimate AST transform utility for regular expressions without any security concerns.
- `dist/transform/utils.js` (safe): No malicious patterns detected
- `dist/traverse/index.js` (safe): This is a standard AST traversal utility with no malicious patterns, network access, or credential harvesting.
- `dist/traverse/node-path.js` (safe): No malicious patterns detected; the code is a standard AST NodePath utility with no network, filesystem, process, or dynamic code execution behavior.
- `dist/utils/clone.js` (safe): Cleared by Jev triage; no further analysis needed
- `index.js` (safe): Cleared by Jev triage; no further analysis needed

AI analysis is guidance, not a guarantee. Methodology: https://security.togoder.click/methodology