Download websites that use XRegExp

About XRegExp

Nobody redesigns a website and asks for a regular expression library. XRegExp arrives on a page the way most utility code does, carried in by something else, a theme, an editor, a form builder or a plugin that needed pattern matching features the browser did not offer when the code was written. Reading a detection as a deliberate choice by the site owner would be a mistake. Reading it as evidence about the components sitting above it is the useful interpretation.

The dating supports that reading. Released in 2007 under MIT, the library filled real gaps in JavaScript at a time when named capture groups, Unicode property matching and readable multiline patterns were not available natively. The language has since absorbed much of that ground. Fresh code written today often has no reason to include the library at all, so a page still serving it is usually serving something built or last touched a good while ago, or a product that still carries a dependency chain from that period.

Version data sharpens the picture. The dataset separates 2 version strings across the detected population, and the value recorded most often is 8759. A narrow spread behaves differently from a fragmented one, because it suggests the sites are not tracking releases individually so much as inheriting whatever version their bundled component shipped with. Sorting the population by version effectively sorts it by the age of the thing that pulled the library in.

As of October 2026 we detect XRegExp on 1,665 sites, and the figure needs a firm caveat. Detection sees the library when it is served as an identifiable file. Bundlers that concatenate and minify dependencies into a single application file erase the identity completely, so the sites in this list are weighted toward simpler and older delivery setups, and the real footprint across the web is larger and leans further toward modern applications than the list can show. The version column carries the same bias, since a build step usually strips the banner comment that makes a version readable.

For a supply chain or dependency researcher, none of that ruins the list, because the question is normally about exposure rather than about total installs. A domain list showing which live sites currently serve a given library, at which version, is the input for estimating the reach of an advisory, for judging whether an old major release is still worth supporting, and for finding front ends that have not been rebuilt in years and are therefore candidates for modernization work. A per domain lookup can confirm one site. Only the full export can answer how large the affected population is, what else those sites run, and whether the population is shrinking between refreshes.