@cdktf/node-pty-prebuilt-multiarch
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| install-scripts | install-script:postinstall | AI (install-scripts): Standard post-install script for native binding; runs node scripts/post-install.js as documented. | ai | |
| install-scripts | install-script:install | AI (install-scripts): Canonical prebuild-install pattern for native Node.js bindings; falls back to node-gyp build. | ai | |
| npm-metadata | bundled-binaries | AI (npm-metadata): Prebuilt native binaries (winpty, .node) are the core deliverable of this multiarch pty package. | ai | |
| semgrep | semgrep:dynamic-require | AI (semgrep): Dynamic require loads native .node addon by path; standard pattern for native bindings. | ai | |
| semgrep | semgrep:child-process-import | AI (semgrep): child_process usage is in test files and is expected for a pty/terminal library. | ai | |
| semgrep | semgrep:child-process-spawn | AI (semgrep): spawn() in test files only; core functionality of a pty library requires process spawning. | ai | |
| phantom-deps | phantom-dep:nan | AI (phantom-deps): nan is a native addon build dependency used via binding.gyp, not directly imported in JS. | ai | |
| phantom-deps | phantom-dep:prebuild-install | AI (phantom-deps): prebuild-install is invoked as a CLI tool in the install script, not imported in JS. | ai |
Versions (showing 1 of 1)
| Version | Deps | Published |
|---|---|---|
| 0.10.2 | 2 / 15 |
v0.10.2
4 findingsScript: node scripts/post-install.js
Script: node scripts/check-prebuild.js || prebuild-install || node scripts/install.js
Package contains compiled binaries that could be backdoors: • prebuilds/win32-x64/abi102/build/Release/winpty.dll • prebuilds/win32-x64/abi108/build/Release/winpty.dll • prebuilds/win32-x64/abi111/build/Release/winpty.dll • prebuilds/win32-x64/abi115/build/Release/winpty.dll • prebuilds/win32-x64/abi120/build/Release/winpty.dll • prebuilds/win32-x64/abi102/build/Release/winpty-agent.exe • prebuilds/win32-x64/abi108/build/Release/winpty-agent.exe • prebuilds/win32-x64/abi111/build/Release/winpty-agent.exe • prebuilds/win32-x64/abi115/build/Release/winpty-agent.exe • prebuilds/win32-x64/abi120/build/Release/winpty-agent.exe ... and 59 more
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.