← Home

@boxlite-ai/boxlite

npm Repository Homepage

BoxLite - Embeddable micro-VM runtime for secure, isolated code execution

32
Versions
Apache-2.0
License
No
Install Scripts
Verified
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures gitHead linked

Maintainers

dorianzheng

Keywords

boxlitesandboxcontainervirtualizationvmkvmhypervisorisolationsecuritycode-execution

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
provenance missing-githead AI (provenance): Consistent with switch to GitHub Actions publishing with SLSA attestation; not a standalone risk indicator here. ai
provenance publisher-changed AI (provenance): Transition to GitHub Actions CI publishing with SLSA attestation is a legitimate and more secure publish flow. ai
semgrep semgrep:child-process-import AI (semgrep): napi-rs musl detection pattern; stable for this native binding package. ai
semgrep semgrep:child-process-execsync AI (semgrep): execSync('ldd --version') is standard napi-rs musl detection; not user-controlled input. ai
semgrep semgrep:dynamic-require AI (semgrep): NAPI_RS_NATIVE_LIBRARY_PATH override is canonical napi-rs loader pattern; stable for this package. ai

Versions (showing 32 of 32)

Version Deps Published
0.9.7 0 / 6
0.9.6 0 / 6
0.9.5 0 / 6
0.9.4 0 / 6
0.9.3 0 / 6
0.9.2 0 / 6
0.9.1 0 / 6
0.9.0 0 / 6
0.8.2 0 / 6
0.8.1 0 / 6
0.8.0 0 / 6
0.4.3 0 / 6
0.4.2 0 / 6
0.4.1 0 / 6
0.4.0 0 / 6
0.3.0 0 / 6
0.2.11 0 / 5
0.2.10 0 / 5
0.2.9 0 / 5
0.2.7 0 / 5
0.2.6 0 / 5
0.2.5 0 / 5
0.2.4 0 / 4
0.2.3 0 / 4
0.2.1 1 / 4
0.1.6 1 / 4
0.1.5 1 / 4
0.1.4 1 / 4
0.1.3 1 / 4
0.1.2 1 / 4
0.1.1 1 / 4
0.1.0 1 / 4

v0.9.7

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.