@img-custom/sharp-libvips-win32-arm64
Prebuilt libvips and dependencies for use with sharp on Windows 64-bit ARM
Supply chain provenance
Status for the latest visible version.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| npm-metadata | bundled-binaries | AI (npm-metadata): Prebuilt native DLL distribution is the explicit purpose of this package; bundled binaries are expected and attested via SLSA provenance. | ai | |
| bogus-package | bogus-package | AI (bogus-package): Empty index.js and no deps are normal for a binary-only distribution package; README link dump is a minor style issue, not spam. | ai |
v0.0.9
2 findingsPackage contains compiled binaries that could be backdoors: • lib/libaom.dll • lib/libarchive-13.dll • lib/libbrotlicommon.dll • lib/libbrotlidec.dll • lib/libbrotlienc.dll • lib/libc++.dll • lib/libcairo-2.dll • lib/libcfitsio.dll • lib/libcgif-0.dll • lib/libdicom-1.dll ... and 51 more
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.0.8
2 findingsPackage contains compiled binaries that could be backdoors: • lib/libaom.dll • lib/libarchive-13.dll • lib/libbrotlicommon.dll • lib/libbrotlidec.dll • lib/libbrotlienc.dll • lib/libc++.dll • lib/libcairo-2.dll • lib/libcfitsio.dll • lib/libcgif-0.dll • lib/libdicom-1.dll ... and 51 more
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.