@cedar-policy/cedar-wasm No license 11 versions

@cedar-policy/cedar-wasm

npm Repository Homepage

11

Versions

—

License

No

Install Scripts

Verified

Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures gitHead linked

Maintainers

szegheon-awsmorevctkevhakcedar-wasm-team

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
npm-metadata	bundled-binaries	AI (npm-metadata): Wasm bindings package; .wasm output is its core deliverable.	ai	2026/07/09
bogus-package	bogus-package	AI (bogus-package): wasm-pack generated bindings legitimately lack repo/deps/keywords.	ai	2026/07/09

Versions (showing 11 of 11)

Version	Deps	Published
4.11.2	0 / 0	2026-06-23
4.11.1	0 / 0	2026-06-09
4.11.0	0 / 0	2026-05-18
4.10.0	0 / 0	2026-04-23
4.9.1	0 / 0	2026-02-27
4.9.0	0 / 0	2026-02-10
4.8.2	0 / 0	2025-12-09
4.8.0	0 / 0	2025-11-19
4.7.0	0 / 0	2025-11-10
4.6.1	0 / 0	2025-11-10
4.5.1	0 / 0	2025-11-10

v4.9.1

2 findings

HIGH Bundled binary files (3) npm-metadata

Package contains compiled binaries that could be backdoors: • esm/cedar_wasm_bg.wasm • nodejs/cedar_wasm_bg.wasm • web/cedar_wasm_bg.wasm

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v4.9.0

2 findings

HIGH Bundled binary files (3) npm-metadata

Package contains compiled binaries that could be backdoors: • esm/cedar_wasm_bg.wasm • nodejs/cedar_wasm_bg.wasm • web/cedar_wasm_bg.wasm

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v4.8.2

2 findings

HIGH Bundled binary files (3) npm-metadata

Package contains compiled binaries that could be backdoors: • esm/cedar_wasm_bg.wasm • nodejs/cedar_wasm_bg.wasm • web/cedar_wasm_bg.wasm

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v4.8.0

2 findings

HIGH Bundled binary files (3) npm-metadata

Package contains compiled binaries that could be backdoors: • esm/cedar_wasm_bg.wasm • nodejs/cedar_wasm_bg.wasm • web/cedar_wasm_bg.wasm

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v4.7.0

2 findings

HIGH Bundled binary files (3) npm-metadata

Package contains compiled binaries that could be backdoors: • esm/cedar_wasm_bg.wasm • nodejs/cedar_wasm_bg.wasm • web/cedar_wasm_bg.wasm

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v4.6.1

2 findings

HIGH Bundled binary files (3) npm-metadata

Package contains compiled binaries that could be backdoors: • esm/cedar_wasm_bg.wasm • nodejs/cedar_wasm_bg.wasm • web/cedar_wasm_bg.wasm

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v4.5.1

2 findings

HIGH Bundled binary files (3) npm-metadata

Package contains compiled binaries that could be backdoors: • esm/cedar_wasm_bg.wasm • nodejs/cedar_wasm_bg.wasm • web/cedar_wasm_bg.wasm

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.