@datadog/wasm-js-rewriter
Datadog instrumentation addon for Node.js
4
Versions
Apache-2.0
License
No
Install Scripts
Attested
Provenance
Supply chain provenance
Status for the latest visible version.
SLSA provenance attestation (unverified)
npm registry signatures
No source commit
Maintainers
datadog
Keywords
datadogrewriter
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| provenance | publisher-changed | AI (provenance): Datadog org migrated to GitHub Actions CI publishing; SLSA attestation confirms legitimate automated release pipeline. | ai | |
| dependencies | unvetted-dep:node-gyp-build | AI (dependencies): node-gyp-build is the standard native addon binary loader; expected for this package type. | ai | |
| semgrep | semgrep:api-obfuscation-reflect | AI (semgrep): Reflect.get in wasm-pack-generated JS glue code; standard WASM host binding pattern. | ai | |
| semgrep | semgrep:base64-decode | AI (semgrep): Decodes inline source map comments — standard source-map parsing, not payload hiding. | ai | |
| phantom-deps | phantom-dep:node-gyp-build | AI (phantom-deps): node-gyp-build is referenced in config/build files for native addon loading; stable false positive. | ai | |
| semgrep | semgrep:new-function-constructor | AI (semgrep): new Function in wasm-pack glue for WASM host bindings; expected pattern for this package. | ai | |
| semgrep | semgrep:dynamic-require | AI (semgrep): Require uses a literal template string path to a bundled snippet file; not truly dynamic. | ai |