@matrix-org/matrix-sdk-crypto-nodejs
2
Versions
—
License
Yes
Install Scripts
Attested
Provenance
Supply chain provenance
Status for the latest visible version.
SLSA provenance attestation (unverified)
npm registry signatures
gitHead linked
Maintainers
matrixdotorg
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| install-scripts | install-script:postinstall | AI (install-scripts): Documented prebuilt-binary download for napi-rs native binding; stable pattern for this package. | ai | |
| semgrep | semgrep:child-process-import | AI (semgrep): Used only to detect musl libc via 'which ldd' for binary selection; not arbitrary execution. | ai | |
| semgrep | semgrep:child-process-execsync | AI (semgrep): Hardcoded 'which ldd' command for musl detection; no user-controlled input, benign for this package. | ai |