@ladybugdb/core
An in-process property graph database management system built for query speed and scalability.
4
Versions
MIT
License
Yes
Install Scripts
Verified
Provenance
Supply chain provenance
Status for the latest visible version.
SLSA provenance attestation
npm registry signatures
No source commit
Maintainers
adsharma
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| provenance | publisher-changed | AI (provenance): Transition to GitHub Actions publisher with SLSA provenance; consistent with CI/CD automation adoption. | ai | |
| phantom-deps | phantom-dep:apache-arrow | AI (phantom-deps): Declared dep may be used indirectly or in config; phantom-dep heuristic is unreliable for this package. | ai | |
| semgrep | semgrep:env-spread | AI (semgrep): env spread is in build/install script to pass env to cmake-js compilation; not exfiltrating secrets. | ai | |
| semgrep | semgrep:child-process-import | AI (semgrep): child_process used in install.js to invoke cmake-js build; expected for native addon compilation. | ai | |
| typosquat | typosquat.levenshtein:cors | AI (typosquat): @ladybugdb/core is a scoped package for a graph DB; not a typosquat of cors. | ai | |
| phantom-deps | phantom-dep:cmake-js | AI (phantom-deps): cmake-js is invoked via child_process in install.js, not imported directly; stable false positive. | ai | |
| phantom-deps | phantom-dep:node-addon-api | AI (phantom-deps): node-addon-api is a C++ header-only dep used at compile time, not imported in JS; stable false positive. | ai | |
| semgrep | semgrep:dynamic-require | AI (semgrep): Dynamic require loads own package.json to derive sub-package name; not arbitrary module loading. | ai | |
| install-scripts | install-script:install | AI (install-scripts): Native addon fetching prebuilt platform binaries via optional sub-packages; standard pattern. | ai |