@cosmology/protobufjs
Protocol Buffers for JavaScript (& TypeScript).
3
Versions
BSD-3-Clause
License
Yes
Install Scripts
Missing
Provenance
Supply chain provenance
Status for the latest visible version.
No SLSA provenance
npm registry signatures
gitHead linked
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
ljunzetazzpyramation
Keywords
protobufprotocol-buffersserializationtypescript
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| provenance | publisher-changed | AI (provenance): pyramation is the established Cosmology team publisher with 2677 approved packages and 2767 days of history; transition from zetazz is a legitimate org consolidation. | ai | |
| maintainer-change | maintainer-added | AI (maintainer-change): New maintainer ljun is part of the Cosmology team; addition is consistent with legitimate org-level maintainer management. | ai | |
| publish-pattern | dormant-publish | AI (publish-pattern): This is a niche ecosystem fork updated infrequently by design; dormancy is expected and publisher track record is strong. | ai | |
| phantom-deps | phantom-dep:@types/long | AI (phantom-deps): TypeScript type package loaded by convention, not direct import. Expected for protobufjs TypeScript support. | ai | |
| phantom-deps | phantom-dep:@types/node | AI (phantom-deps): TypeScript type package for Node.js, loaded by convention. Standard for any Node.js TypeScript package. | ai | |
| phantom-deps | phantom-dep:long | AI (phantom-deps): long is an optional runtime dependency for protobufjs; referenced in config but loaded conditionally. Standard protobufjs pattern. | ai | |
| install-scripts | install-script:postinstall | AI (install-scripts): Postinstall is the standard protobufjs version-scheme check that reads local package.json; benign and inherited from upstream protobufjs. | ai | |
| semgrep | semgrep:child-process-exec | AI (semgrep): child_process.exec in pbts.js runs jsdoc with a resolved path — standard CLI tooling behavior for this package. | ai | |
| semgrep | semgrep:child-process-import | AI (semgrep): child_process used in pbts.js CLI tool to invoke jsdoc for TypeScript definition generation — expected, documented behavior. | ai | |
| semgrep | semgrep:dynamic-require | AI (semgrep): Dynamic require loads local package.json via path.join(__dirname, '..', 'package.json'); not arbitrary code execution, benign upstream pattern. | ai |