
Security News
TC39 Advances Temporal to Stage 4 Alongside Several ECMAScript Proposals
TC39’s March 2026 meeting advanced eight ECMAScript proposals, including Temporal reaching Stage 4 and securing its place in the ECMAScript 2026 specification.
zeptomatch
Advanced tools
An absurdly small glob matcher that packs a punch.
The following syntax is supported:
| Syntax | Description |
|---|---|
* | Matches any character, except for the path separator, zero or more times. |
** | Matches any character zero or more times. If it doesn't span the entire length of a path segment it's interpreted as a * instead. |
? | Matches any character, except for the path separator, one time. |
\ | Matches the character after it in the glob literally. This is the escape operator. |
[abc] | Matches any of the characters in the class one time. |
[a-z] | Matches any of the characters in the range in the class one time. |
[^abc] | Matches any character, except for the characters in the class, and the path separator, one time. Aliased as [!abc] also. |
[^a-z] | Matches any character, except for the characters in the range in the class, and the path separator, one time. Aliased as [!a-z] also. |
{foo,bar} | Matches any of the alternations, which are separated by a comma, inside the braces. |
{01..99} | Matches any of the numbers in the expanded range. Padding is supported and opt-in. |
{a..zz} | Matches any of the strings in the expanded range. Upper-cased ranges are supported and opt-in. |
!glob | Matches anything except the provided glob. Negations can only be used at the start of the glob. |
!!glob | Matches the provided glob. Negations can only be used at the start of the glob. |
Additional features and details:
picomatch, since 1000+ of its tests are being used by this library.Limitations:
[:alnum:]) are not supported. Implementing them is out of scope for a "zepto"-level library.?(foo)) are not supported. They are too complicated and quirky too support here.npm install zeptomatch
import zeptomatch from 'zeptomatch';
// Let's check if a glob matches a path, fully
zeptomatch ( '*.js', 'abcd' ); // => false
zeptomatch ( '*.js', 'a.js' ); // => true
zeptomatch ( '*.js', 'a.md' ); // => false
zeptomatch ( '*.js', 'a/b.js' ); // => false
// Let's check if a glob matches a path, partially
// Matching partially is very useful for performance when traversing the filesystem
// It's important to not match the glob partially anymore once you have the full path available though!
zeptomatch ( 'foo/bar/*.js', 'foo', { partial: true } ); // => true
zeptomatch ( 'foo/bar/*.js', 'foo/bar', { partial: true } ); // => true
zeptomatch ( 'foo/bar/*.js', 'foo/bar/_', { partial: true } ); // => false, as no additional path segment could ever make this match
zeptomatch ( 'foo/bar/*.js', 'foo/bar/file.js' ); // => true, remember to not match the full path partially
// Let's compile a glob to a regular expression that matches fully
const fullRe = zeptomatch.compile ( 'src/*.js' ); // => /^(?:src[\\/][^\\/]*\.js)[\\/]?$/s
// Let's compile a glob to a regular expression that matches partially
const partialRe = zeptomatch.compile ( '*.js', { partial: true } ); // => /^(?:src(?:$|[\\/](?:$|[^\\/]*\.js)))[\\/]?$/s
The following additional utilities are available, as standalone packages:
zeptomatch-escape: A little utility for escaping globs before passing them to zeptomatch.zeptomatch-explode: A little utility for exploding a zeptomatch-flavored glob into its dynamic and static parts.zeptomatch-is-static: A little utility for checking if a glob is fully static.zeptomatch-unescape: A little utility for removing escape sequences from a glob.MIT © Fabio Spampinato
FAQs
An absurdly small glob matcher that packs a punch.
The npm package zeptomatch receives a total of 2,212,459 weekly downloads. As such, zeptomatch popularity was classified as popular.
We found that zeptomatch demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
TC39’s March 2026 meeting advanced eight ECMAScript proposals, including Temporal reaching Stage 4 and securing its place in the ECMAScript 2026 specification.

Research
/Security News
Since January 31, 2026, we identified at least 72 additional malicious Open VSX extensions, including transitive GlassWorm loader extensions targeting developers.

Research
Six malicious Packagist packages posing as OphimCMS themes contain trojanized jQuery that exfiltrates URLs, injects ads, and loads FUNNULL-linked redirects.