@abandonware/noble
A Node.js BLE (Bluetooth Low Energy) central library.
10
Versions
MIT
License
No
Install Scripts
Missing
Provenance
Supply chain provenance
Status for the latest visible version.
No SLSA provenance
npm registry signatures
No source commit
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
rzrrzrfreefr
Keywords
bluetoothBLEbluetooth low energybluetooth smartcentral
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | source-size-tripled | AI (source-diff): Size increase is explained by large test files and package-lock.json added in this version, not injected payloads. | ai | |
| semgrep | semgrep:child-process-exec | AI (semgrep): Hardcoded system_profiler command for Bluetooth address retrieval; legitimate platform integration, not arbitrary code execution. | ai | |
| dependencies | unvetted-dep:bplist-parser | AI (dependencies): bplist-parser is an optional macOS-specific dependency for parsing Apple binary property lists, appropriate for a BLE library targeting macOS. | ai | |
| dependencies | unvetted-dep:xpc-connection | AI (dependencies): xpc-connection is an optional macOS-specific dependency for XPC IPC, appropriate for a BLE library targeting macOS Bluetooth stack. | ai | |
| semgrep | semgrep:child-process-import | AI (semgrep): child_process import is used for legitimate platform-specific Bluetooth address discovery on macOS; expected for BLE library. | ai | |
| source-diff | large-new-source-files | AI (source-diff): Noble is an actively developed BLE library; new source files reflect legitimate feature additions (platform bindings, distributed architecture). No malicious content indicated. | ai | |
| publish-pattern | dormant-publish | AI (publish-pattern): abandonware org maintains unmaintained packages; long gaps between releases are expected and not indicative of account takeover given clean publisher history. | ai | |
| provenance | no-provenance | AI (provenance): Established package with long history and clean publisher track record; lack of Sigstore provenance is not a security risk for this package. | ai | |
| dependencies | unvetted-dep:node-gyp-build | AI (dependencies): node-gyp-build is a well-known, widely-used utility for native addon prebuilt binary loading; appropriate dependency for this native BLE library. | ai | |
| publish-pattern | new-deps-added | AI (publish-pattern): node-gyp-build addition is consistent with adding native addon prebuilt binary support; not a supply-chain risk in this context. | ai | |
| semgrep | semgrep:hex-decode | AI (semgrep): Hex decoding in BLE event handling is legitimate — binary Bluetooth data is serialized as hex for IPC transport. No malicious payload risk. | ai | |
| install-scripts | install-script:install | AI (install-scripts): noble is a BLE native addon; node-gyp-build install script is the standard pattern for loading prebuilt binaries. Stable for this package. | ai | |
| semgrep | semgrep:dynamic-require | AI (semgrep): tryRequire in lib/manufacture.js is a safe optional-load pattern for manufacturer data; no arbitrary user-controlled input. | ai | |
| dependencies | unvetted-dep:node-addon-api | AI (dependencies): node-addon-api is the official Node.js N-API C++ wrapper; required for native BLE bindings. Stable false positive for this native addon package. | ai | |
| dependencies | unvetted-dep:debug | AI (dependencies): debug is a ubiquitous, well-trusted npm logging utility; flagging it as unvetted is a stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:node-addon-api | AI (phantom-deps): node-addon-api is referenced in native build config (binding.gyp), not JS imports — standard pattern for N-API native addons. | ai | |
| phantom-deps | phantom-dep:napi-thread-safe-callback | AI (phantom-deps): napi-thread-safe-callback is a native addon build dependency referenced in config files, not JS imports — standard N-API pattern. | ai |