@newrelic/security-agent
New Relic Security Agent for Node.js
6
Versions
New Relic Software License v1.0
License
No
Install Scripts
Verified
Provenance
Supply chain provenance
Status for the latest visible version.
SLSA provenance attestation
npm registry signatures
gitHead linked
Maintainers
newrelic
Keywords
instrumentationIASTRASPNew Relic Security AgentNode.js Application Security
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| provenance | slsa-provenance | AI (provenance): SLSA provenance via Sigstore/CI is a strong integrity signal for this New Relic org package. | ai | |
| semgrep | semgrep:base64-decode | AI (semgrep): Decoding fuzz request headers in gRPC hook; expected for IAST agent functionality. | ai | |
| semgrep | semgrep:eval-usage | AI (semgrep): Eval used for generator function feature detection, not arbitrary input execution. Stable pattern for this security agent. | ai | |
| semgrep | semgrep:child-process-import | AI (semgrep): Security instrumentation agent legitimately imports child_process to monitor system calls; expected for IAST/RASP tooling. | ai | |
| semgrep | semgrep:dynamic-require | AI (semgrep): Dynamic require resolves own package.json for version info using a known config constant; not user-controlled input. | ai |