@homebridge/node-pty-prebuilt-multiarch
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| semgrep | semgrep:child-process-import | AI (semgrep): child_process import is in test files (unixTerminal.test.js), not runtime code. Expected for a terminal emulation library's test suite. | ai | |
| semgrep | semgrep:child-process-spawn | AI (semgrep): child_process.spawn in test files only; used to test PTY behavior. Not a runtime risk. | ai | |
| npm-metadata | bundled-binaries | AI (npm-metadata): Bundled .node prebuilds and ConPTY DLLs are the core purpose of this 'prebuilt-multiarch' package. Expected and legitimate. | ai | |
| semgrep | semgrep:dynamic-require | AI (semgrep): Dynamic require loads the native .node addon from a computed path — standard pattern for native Node.js addons. | ai | |
| install-scripts | install-script:postinstall | AI (install-scripts): Postinstall runs node scripts/post-install.js — standard native addon post-install step for node-pty-prebuilt-multiarch. Stable across versions. | ai | |
| phantom-deps | phantom-dep:node-addon-api | AI (phantom-deps): node-addon-api is used at build/compile time for native addon; phantom classification is a false positive here. | ai | |
| phantom-deps | phantom-dep:prebuild-install | AI (phantom-deps): prebuild-install is used implicitly during install script execution; false positive for native addon packages. | ai | |
| install-scripts | install-script:install | AI (install-scripts): Install script uses prebuild-install pattern to fetch prebuilt binaries or compile from source — canonical native addon install flow for this package. | ai |
v0.14.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.13.1
4 findingsScript: node scripts/post-install.js
Script: node scripts/check-prebuild.js || prebuild-install --verbose || node scripts/install.js
Package contains compiled binaries that could be backdoors: • third_party/conpty/1.22.250204002/win10-arm64/conpty.dll • third_party/conpty/1.22.250204002/win10-x64/conpty.dll • third_party/conpty/1.22.250204002/win10-arm64/OpenConsole.exe • third_party/conpty/1.22.250204002/win10-x64/OpenConsole.exe • prebuilds/linux-arm/node.abi102.musl.node • prebuilds/linux-arm64/node.abi102.musl.node • prebuilds/linux-x64/node.abi102.musl.node • prebuilds/linux-arm/node.abi102.node • prebuilds/linux-arm/node.abi108.musl.node • prebuilds/linux-arm64/node.abi108.musl.node ... and 47 more
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.