@mdpdf/mdpdf-darwin-arm64 MIT 2 versions

@mdpdf/mdpdf-darwin-arm64

npm Repository Homepage

Convert Markdown to PDF using a self-contained Rust binary

Versions

MIT

License

Install Scripts

Verified

Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures gitHead linked

westrik

markdownpdftypstrustnapi-rs

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
npm-metadata	bundled-binaries	AI (npm-metadata): Platform-specific napi-rs native binding; the .node file is the package's sole deliverable, backed by SLSA provenance.	ai	2026/05/01
bogus-package	bogus-package	AI (bogus-package): No-dep, sparse-README pattern is expected for a platform-specific binary sub-package in a napi-rs split distribution.	ai	2026/05/01

Version	Deps	Published
0.1.6	0 / 0	2026-04-29
0.1.5	0 / 0	2026-04-28

2 findings

HIGH Bundled binary files (1) npm-metadata

Package contains compiled binaries that could be backdoors: • mdpdf.darwin-arm64.node

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.