@herb-tools/node
Native Node.js addon for HTML-aware ERB parsing using Herb.
9
Versions
MIT
License
Yes
Install Scripts
Missing
Provenance
Supply chain provenance
Status for the latest visible version.
No SLSA provenance
npm registry signatures
gitHead linked
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
marcoroth
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| bogus-package | bogus-package | AI (bogus-package): Cosmetic signals only (short README, no keywords). Package has real functionality, 39 versions, 375 days old, and 182 weekly downloads. | ai | |
| typosquat | typosquat.levenshtein:zod | AI (typosquat): Scoped package @herb-tools/node is not impersonating zod; Levenshtein match is a false positive. Package is a native addon for ERB parsing with 375 days of history. | ai | |
| semgrep | semgrep:child-process-import | AI (semgrep): execSync in bin/vendor.cjs is used to set up native build dependencies (prism). Standard pattern for native addon build tooling. | ai | |
| install-scripts | install-script:install | AI (install-scripts): node-pre-gyp install --fallback-to-build is the canonical install pattern for native Node.js addons fetching prebuilt binaries from GitHub releases. Stable for this package. | ai | |
| phantom-deps | phantom-dep:node-addon-api | AI (phantom-deps): node-addon-api is referenced in binding.gyp for native compilation, not imported in JS. Normal for native addon packages. | ai | |
| phantom-deps | phantom-dep:node-pre-gyp-github | AI (phantom-deps): node-pre-gyp-github is a build/publish tool referenced in scripts, not imported in JS. Normal for native addon packages. | ai | |
| semgrep | semgrep:dynamic-require | AI (semgrep): require(libherbPath) loads the native .node binary via node-pre-gyp's binary.find(). Standard pattern for native addon loading; path is not user-controlled. | ai |