← Home

@confluentinc/kafka-javascript

npm Repository Homepage
4
Versions
—
License
Yes
Install Scripts
Missing
Provenance

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.

Maintainers

confluent-npmspanwar

Keywords

kafkalibrdkafka

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
phantom-deps phantom-dep:tar AI (phantom-deps): Used in install/build tooling, not directly imported in JS source; expected pattern for native binding packages. ai
phantom-deps phantom-dep:js-yaml AI (phantom-deps): Used in install/build tooling, not directly imported in JS source; expected pattern for native binding packages. ai
install-scripts install-script:install AI (install-scripts): node-pre-gyp install --fallback-to-build is the standard install pattern for native Node.js addons; stable and expected for this librdkafka binding package. ai
semgrep semgrep:child-process-import AI (semgrep): child_process in util/configure.js is used for build configuration in a native addon — standard pattern, not a security concern for this package. ai
phantom-deps phantom-dep:nan AI (phantom-deps): nan is a declared runtime dep used at the C++ native binding layer, not directly imported in JS. Normal for native addons. ai
phantom-deps phantom-dep:@mapbox/node-pre-gyp AI (phantom-deps): @mapbox/node-pre-gyp is referenced in build/config files as expected for native addon binary management; not a phantom dep concern. ai

Versions (showing 4 of 4)

Version Deps Published
1.10.0 5 / 19
1.9.1 3 / 19
1.9.0 3 / 19
1.5.0 3 / 19

v1.10.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.