@boundaryml/baml No license 33 versions

@boundaryml/baml

npm Repository Homepage

33

Versions

—

License

No

Install Scripts

Verified

Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures No source commit

Maintainers

aaronvghellovai-boundarysxlijin

Keywords

napi-rsNAPIN-APIRustnode-addonnode-addon-api

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
semgrep	semgrep:child-process-import	AI (semgrep): execSync('ldd --version') is standard napi-rs pattern to detect musl vs glibc for selecting the correct prebuilt binary. Stable and benign for this package.	ai	2026/04/26
semgrep	semgrep:child-process-execsync	AI (semgrep): execSync('ldd --version') is standard napi-rs musl detection pattern. Fixed command, no user input, no arbitrary execution risk.	ai	2026/04/26
semgrep	semgrep:dynamic-require	AI (semgrep): require(NAPI_RS_NATIVE_LIBRARY_PATH) is a documented napi-rs escape hatch for overriding native library path. Standard pattern for this type of package.	ai	2026/04/26
phantom-deps	phantom-dep:@scarf/scarf	AI (phantom-deps): @scarf/scarf is a legitimate telemetry dependency declared in package.json; it is loaded via package.json config rather than explicit require(), so phantom-dep detection is a false positive here.	ai	2026/04/26

Versions (showing 33 of 133)

Version	Deps	Published
0.39.1	0 / 6	2024-06-13
0.39.0	0 / 6	2024-06-11
0.37.0	0 / 6	2024-06-11
0.36.0	0 / 6	2024-06-07
0.35.0	0 / 6	2024-06-05
0.34.0	0 / 6	2024-06-03
0.33.1	0 / 6	2024-06-01
0.33.0	0 / 6	2024-06-01
0.32.0	0 / 6	2024-05-31
0.30.0	0 / 6	2024-05-30
0.0.27	0 / 6	2024-05-30
0.0.26	0 / 6	2024-05-29
0.0.25	0 / 6	2024-05-29
0.0.24	0 / 6	2024-05-28
0.0.23	0 / 6	2024-05-28
0.0.22	0 / 6	2024-05-28
0.0.21	0 / 6	2024-05-27
0.0.20	0 / 6	2024-05-27
0.0.18	0 / 6	2024-05-27
0.0.17	0 / 6	2024-05-26
0.0.15	0 / 6	2024-05-26
0.0.14	0 / 6	2024-05-26
0.0.13	0 / 6	2024-05-26
0.0.11	0 / 6	2024-05-25
0.0.10	0 / 6	2024-05-25
0.0.9	0 / 6	2024-05-25
0.0.8	0 / 6	2024-05-25
0.0.7	0 / 6	2024-05-25
0.0.6	0 / 6	2024-05-25
0.0.5	0 / 6	2024-05-25
0.0.4	6 / 6	2024-05-25
0.0.2	6 / 5	2024-05-11
0.0.1	0 / 5	2024-05-11

v0.39.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.39.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.37.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.36.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.35.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.34.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.33.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.33.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.32.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.30.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.0.27

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.0.26

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.0.25

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.0.24

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.0.23

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.0.22

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.0.21

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.0.20

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.0.18

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.0.17

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.0.15

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.0.14

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.0.13

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.0.11

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.0.10

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.0.9

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.0.8

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.0.7

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.0.6

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.0.5

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.0.4

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.0.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.0.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.