picomatch

Blazing fast and accurate glob matcher written in JavaScript, with no dependencies and full support for standard and extended Bash glob features, including braces, extglobs, POSIX brackets, and regular expressions.

Latest 4.0.7

NPM

88%

Total Score

Maintainer Stability

100

Dependencies

100

Maturity

Supply Chain

Attestations

Are you affected? Scan for Free

Health Score Breakdown

Build provenance

No build attestation or trusted-publisher provenance was detected. This limits publication transparency, but the repository, release notes, license, and package contents align consistently.

Repo tooling

The repository uses a build tool, but no security-scanning tools were detected. The missing scanning is a modest transparency and maintenance gap, partly offset by the active project and repository security policy.

Token permissions

The single analyzed workflow declares top-level write permissions. Although no dangerous workflow patterns were detected, broader-than-read-only token access increases CI compromise impact.

Type declarations

No type declarations are included. This is a consumer ergonomics gap for TypeScript users, but the package is a small JavaScript library with clear README API documentation, so it does not indicate abandonment or an unsafe release.

Vulnerabilities

Title	Versions	Severity
CVE-2026-33672 picomatch is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in versions 4.0.0 - 4.0.4, 3.0.0 - 3.0.2 and 0.0.0 - 2.3.2.	0.0.0 - 2.3.23.0.0 - 3.0.24.0.0 - 4.0.4	Medium
CVE-2026-33671 picomatch is vulnerable to Inefficient Regular Expression Complexity in versions 4.0.0 - 4.0.4, 3.0.0 - 3.0.2 and 0.0.0 - 2.3.2.	0.0.0 - 2.3.23.0.0 - 3.0.24.0.0 - 4.0.4	High