@datadog/native-iast-taint-tracking Apache-2.0 3 versions

@datadog/native-iast-taint-tracking

npm Repository Homepage

Datadog IAST tant tracking support for NodeJS

Versions

Apache-2.0

License

Yes

Install Scripts

Verified

Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures No source commit

datadog

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
publish-pattern	dormant-publish	AI (publish-pattern): Established Datadog native module with long-standing release cadence, not account takeover.	ai	2026/07/08
install-scripts	install-script:install	AI (install-scripts): Install script is literally `exit 0` — a no-op placeholder; stable for this native addon package.	ai	2026/05/04
npm-metadata	bundled-binaries	AI (npm-metadata): Prebuilt .node binaries are the expected distribution mechanism for this native addon; SLSA provenance confirms CI/CD build integrity.	ai	2026/05/04
semgrep	semgrep:child-process-import	AI (semgrep): child_process used in libc.js to detect Linux libc variant for prebuild selection — standard native addon pattern.	ai	2026/05/04

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.