← Home

@appium/base-driver

npm Repository Homepage
17
Versions
—
License
No
Install Scripts
Verified
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures gitHead linked

Maintainers

jlippsnick.mokhnachkazucocoa

Keywords

androidautomationfirefoxosiosjavascriptseleniumtestingwebdriver

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
source-diff net-exec-file:test-fixtures/static/js/jquery.min.js AI (source-diff): jQuery v1.9.1 minified in test-fixtures; not malicious code. ai
provenance publisher-changed AI (provenance): Transition from human publisher (jlipps) to GitHub Actions CI/CD with SLSA provenance. Standard modernization for the Appium project. ai
maintainer-change maintainer-removed AI (maintainer-change): Routine maintainer list change in a large, well-established project (Appium). Not indicative of takeover. ai
publish-pattern dormant-publish AI (publish-pattern): Monorepo package; parent appium/appium repo is active. Individual packages release only when their code changes. ai
semgrep semgrep:new-function-constructor AI (semgrep): new Function() is used to compile a developer-controlled HTTP log format string into a formatter function — a standard logging middleware pattern, not a runtime injection risk. ai
dependencies unvetted-dep:@appium/types AI (dependencies): First-party Appium package from the same monorepo; legitimate and well-maintained. ai
dependencies unvetted-dep:@appium/support AI (dependencies): First-party Appium package from the same monorepo; legitimate and well-maintained. ai
dependencies unvetted-dep:http-status-codes AI (dependencies): Widely-used, well-known HTTP status code utility library with no known security issues. ai

Versions (showing 17 of 17)

Version Deps Published
10.7.2 15 / 0
10.7.1 15 / 0
10.7.0 15 / 0
10.6.0 16 / 0
10.5.2 18 / 0
10.5.1 18 / 0
10.5.0 18 / 0
10.4.0 18 / 0
10.3.0 18 / 0
10.2.2 18 / 0
10.2.1 18 / 0
10.2.0 18 / 0
10.1.2 19 / 0
10.1.1 19 / 0
10.1.0 19 / 0
10.0.1 19 / 0
10.0.0 19 / 0

v10.7.2

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.