@abandonware/noble

A Node.js BLE (Bluetooth Low Energy) central library.

Supply chain provenance

Status for the latest visible version.

Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.

Maintainers

Keywords

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
source-diff	source-size-tripled	AI (source-diff): Size increase is explained by large test files and package-lock.json added in this version, not injected payloads.	ai	2026/04/21
semgrep	semgrep:child-process-exec	AI (semgrep): Hardcoded system_profiler command for Bluetooth address retrieval; legitimate platform integration, not arbitrary code execution.	ai	2026/04/21
dependencies	unvetted-dep:bplist-parser	AI (dependencies): bplist-parser is an optional macOS-specific dependency for parsing Apple binary property lists, appropriate for a BLE library targeting macOS.	ai	2026/04/21
dependencies	unvetted-dep:xpc-connection	AI (dependencies): xpc-connection is an optional macOS-specific dependency for XPC IPC, appropriate for a BLE library targeting macOS Bluetooth stack.	ai	2026/04/21
semgrep	semgrep:child-process-import	AI (semgrep): child_process import is used for legitimate platform-specific Bluetooth address discovery on macOS; expected for BLE library.	ai	2026/04/21
source-diff	large-new-source-files	AI (source-diff): Noble is an actively developed BLE library; new source files reflect legitimate feature additions (platform bindings, distributed architecture). No malicious content indicated.	ai	2026/04/21
publish-pattern	dormant-publish	AI (publish-pattern): abandonware org maintains unmaintained packages; long gaps between releases are expected and not indicative of account takeover given clean publisher history.	ai	2026/04/21
provenance	no-provenance	AI (provenance): Established package with long history and clean publisher track record; lack of Sigstore provenance is not a security risk for this package.	ai	2026/04/21
dependencies	unvetted-dep:node-gyp-build	AI (dependencies): node-gyp-build is a well-known, widely-used utility for native addon prebuilt binary loading; appropriate dependency for this native BLE library.	ai	2026/04/21
publish-pattern	new-deps-added	AI (publish-pattern): node-gyp-build addition is consistent with adding native addon prebuilt binary support; not a supply-chain risk in this context.	ai	2026/04/21
semgrep	semgrep:hex-decode	AI (semgrep): Hex decoding in BLE event handling is legitimate — binary Bluetooth data is serialized as hex for IPC transport. No malicious payload risk.	ai	2026/04/21
install-scripts	install-script:install	AI (install-scripts): noble is a BLE native addon; node-gyp-build install script is the standard pattern for loading prebuilt binaries. Stable for this package.	ai	2026/04/21
semgrep	semgrep:dynamic-require	AI (semgrep): tryRequire in lib/manufacture.js is a safe optional-load pattern for manufacturer data; no arbitrary user-controlled input.	ai	2026/04/21
dependencies	unvetted-dep:node-addon-api	AI (dependencies): node-addon-api is the official Node.js N-API C++ wrapper; required for native BLE bindings. Stable false positive for this native addon package.	ai	2026/04/21
dependencies	unvetted-dep:debug	AI (dependencies): debug is a ubiquitous, well-trusted npm logging utility; flagging it as unvetted is a stable false positive for this package.	ai	2026/04/21
phantom-deps	phantom-dep:node-addon-api	AI (phantom-deps): node-addon-api is referenced in native build config (binding.gyp), not JS imports — standard pattern for N-API native addons.	ai	2026/04/21
phantom-deps	phantom-dep:napi-thread-safe-callback	AI (phantom-deps): napi-thread-safe-callback is a native addon build dependency referenced in config files, not JS imports — standard N-API pattern.	ai	2026/04/21

Version	Deps	Published