@node-core/utils
Utilities for Node.js core collaborators
10
Versions
MIT
License
No
Install Scripts
Verified
Provenance
Supply chain provenance
Status for the latest visible version.
SLSA provenance attestation
npm registry signatures
gitHead linked
Maintainers
nodejs-foundation
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| semgrep | semgrep:env-spread | AI (semgrep): Passing process.env to child process for git operations; standard subprocess pattern, not exfiltration. | ai | |
| semgrep | semgrep:ssh-key-access | AI (semgrep): Prompts user for their own SSH key path for release signing; not credential theft. | ai | |
| semgrep | semgrep:eval-usage | AI (semgrep): Parses Chromium DEPS file format via eval; well-known pattern in Node.js V8 update tooling. | ai | |
| bogus-package | bogus-package | AI (bogus-package): Official nodejs org tooling; sparse README/keywords are not spam indicators here. | ai |