@gjsify/video
VideoBridge — GTK container for HTMLVideoElement backed by GStreamer gtk4paintablesink
5
Versions
—
License
No
Install Scripts
Missing
Provenance
Supply chain provenance
Status for the latest visible version.
No SLSA provenance
npm registry signatures
No source commit
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
jumplinkschanzewlsh
Keywords
gjsgtkvideogstreamerbridge
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| dependencies | unvetted-dep:@girs/gdkpixbuf-2.0 | AI (dependencies): Official @girs GIR type binding, same family as existing deps. | ai | |
| provenance | publisher-changed | AI (provenance): CI/CD (GitHub Actions) publisher for monorepo, consistent with automated release pipeline. | ai | |
| phantom-deps | phantom-dep:@girs/gdkpixbuf-2.0 | AI (phantom-deps): Type-only GIR binding referenced via config, same pattern as other accepted @girs phantom deps. | ai | |
| phantom-deps | phantom-dep:@gjsify/event-bridge | AI (phantom-deps): Same-org dep used transitively; not directly imported but legitimately declared. | ai | |
| phantom-deps | phantom-dep:@gjsify/dom-exception | AI (phantom-deps): Same-org dep used transitively; not directly imported but legitimately declared. | ai | |
| phantom-deps | phantom-dep:@gjsify/dom-events | AI (phantom-deps): Same-org dep used transitively; not directly imported but legitimately declared. | ai | |
| dependencies | unvetted-dep:@girs/gtk-4.0 | AI (dependencies): GTK4 type bindings; expected for GTK4-based GJS library. | ai | |
| dependencies | unvetted-dep:@girs/gjs | AI (dependencies): GJS type bindings; expected dependency for a GJS/GTK library in the @gjsify ecosystem. | ai | |
| dependencies | unvetted-dep:@girs/gdk-4.0 | AI (dependencies): GDK type bindings; expected for GTK4-based GJS library. | ai | |
| dependencies | unvetted-dep:@girs/gst-1.0 | AI (dependencies): GStreamer type bindings; expected for GStreamer-backed video package. | ai | |
| dependencies | unvetted-dep:@girs/glib-2.0 | AI (dependencies): GLib type bindings; expected for GJS/GTK library. | ai | |
| dependencies | unvetted-dep:@girs/gobject-2.0 | AI (dependencies): GObject type bindings; expected for GJS/GTK library. | ai | |
| typosquat | typosquat.levenshtein:vite | AI (typosquat): @gjsify/video is a GTK video bridge; no relation to vite. Levenshtein match is coincidental. | ai | |
| phantom-deps | phantom-dep:@girs/gobject-2.0 | AI (phantom-deps): GObject type bindings referenced in config; not directly imported by design. | ai | |
| phantom-deps | phantom-dep:@girs/glib-2.0 | AI (phantom-deps): GLib type bindings referenced in config; not directly imported by design. | ai | |
| phantom-deps | phantom-dep:@girs/gtk-4.0 | AI (phantom-deps): GTK type bindings referenced in config; not directly imported by design. | ai | |
| phantom-deps | phantom-dep:@girs/gst-1.0 | AI (phantom-deps): GStreamer type bindings referenced in config; not directly imported by design. | ai |
Versions (showing 5 of 5)
| Version | Deps | Published |
|---|---|---|
| 0.13.0 | 12 / 3 | |
| 0.4.42 | 12 / 3 | |
| 0.4.11 | 11 / 3 | |
| 0.3.20 | 11 / 3 | |
| 0.1.15 | 10 / 3 |
v0.13.0
2 findings
HIGH
Publisher changed: jumplink → GitHub Actions (on 2026-06-27)
provenance
This version was published by a different npm account than previous versions on 2026-06-27. This could indicate a legitimate maintainer transition or an account compromise.
LOW
No provenance attestation
provenance
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.