@node-rs/xxhash
9
Versions
—
License
No
Install Scripts
Verified
Provenance
Supply chain provenance
Status for the latest visible version.
SLSA provenance attestation
npm registry signatures
gitHead linked
Maintainers
broooooklyndxd_sjtu
Keywords
hashxxhashxxhashjsRustnode-rsnapinapi-rsN-APINode-API
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| publish-pattern | new-deps-added | AI (publish-pattern): Standard napi-rs per-platform optional binary deps pinned to package version; not a supply-chain risk. | ai | |
| phantom-deps | phantom-dep:@node-rs/xxhash-android-arm-eabi | AI (phantom-deps): Platform-specific optional dep; stable pattern for napi-rs native bindings. | ai | |
| phantom-deps | phantom-dep:@node-rs/xxhash-darwin-arm64 | AI (phantom-deps): Platform-specific optional deps for NAPI binding; stable pattern for this package. | ai | |
| phantom-deps | phantom-dep:@node-rs/xxhash-android-arm64 | AI (phantom-deps): Platform-specific optional deps for NAPI binding; stable pattern for this package. | ai | |
| phantom-deps | phantom-dep:@node-rs/xxhash-linux-x64-gnu | AI (phantom-deps): Platform-specific optional deps for NAPI binding; stable pattern for this package. | ai | |
| phantom-deps | phantom-dep:@node-rs/xxhash-linux-x64-musl | AI (phantom-deps): Platform-specific optional deps for NAPI binding; stable pattern for this package. | ai | |
| phantom-deps | phantom-dep:@node-rs/xxhash-win32-x64-msvc | AI (phantom-deps): Platform-specific optional deps for NAPI binding; stable pattern for this package. | ai | |
| phantom-deps | phantom-dep:@node-rs/xxhash-darwin-x64 | AI (phantom-deps): Platform-specific optional deps for NAPI binding; stable pattern for this package. | ai | |
| phantom-deps | phantom-dep:@node-rs/xxhash-win32-ia32-msvc | AI (phantom-deps): Platform-specific optional deps for NAPI binding; stable pattern for this package. | ai | |
| phantom-deps | phantom-dep:@node-rs/xxhash-linux-arm64-musl | AI (phantom-deps): Platform-specific optional deps for NAPI binding; stable pattern for this package. | ai | |
| phantom-deps | phantom-dep:@node-rs/xxhash-win32-arm64-msvc | AI (phantom-deps): Platform-specific optional deps for NAPI binding; stable pattern for this package. | ai | |
| phantom-deps | phantom-dep:@node-rs/xxhash-linux-arm-gnueabihf | AI (phantom-deps): Platform-specific optional deps for NAPI binding; stable pattern for this package. | ai | |
| phantom-deps | phantom-dep:@node-rs/xxhash-linux-arm64-gnu | AI (phantom-deps): Platform-specific optional deps for NAPI binding; stable pattern for this package. | ai | |
| phantom-deps | phantom-dep:@node-rs/xxhash-freebsd-x64 | AI (phantom-deps): Platform-specific optional deps for NAPI binding; stable pattern for this package. | ai | |
| semgrep | semgrep:child-process-import | AI (semgrep): Only used for musl detection via `ldd --version`, not arbitrary exec. | ai | |
| dependencies | unvetted-dep:@node-rs/xxhash-darwin-x64 | AI (dependencies): Official same-org napi-rs platform binary, pinned exact version. | ai | |
| semgrep | semgrep:child-process-execsync | AI (semgrep): Only used for musl detection via `ldd --version`, not arbitrary exec. | ai | |
| dependencies | unvetted-dep:@node-rs/xxhash-freebsd-x64 | AI (dependencies): Official same-org napi-rs platform binary, pinned exact version. | ai | |
| dependencies | unvetted-dep:@node-rs/xxhash-wasm32-wasi | AI (dependencies): Official same-org napi-rs platform binary, pinned exact version. | ai | |
| dependencies | unvetted-dep:@node-rs/xxhash-darwin-arm64 | AI (dependencies): Official same-org napi-rs platform binary, pinned exact version. | ai | |
| dependencies | unvetted-dep:@node-rs/xxhash-android-arm64 | AI (dependencies): Official same-org napi-rs platform binary, pinned exact version. | ai | |
| dependencies | unvetted-dep:@node-rs/xxhash-linux-x64-gnu | AI (dependencies): Official same-org napi-rs platform binary, pinned exact version. | ai | |
| dependencies | unvetted-dep:@node-rs/xxhash-linux-x64-musl | AI (dependencies): Official same-org napi-rs platform binary, pinned exact version. | ai | |
| dependencies | unvetted-dep:@node-rs/xxhash-win32-x64-msvc | AI (dependencies): Official same-org napi-rs platform binary, pinned exact version. | ai | |
| dependencies | unvetted-dep:@node-rs/xxhash-linux-arm64-gnu | AI (dependencies): Official same-org napi-rs platform binary, pinned exact version. | ai | |
| dependencies | unvetted-dep:@node-rs/xxhash-win32-ia32-msvc | AI (dependencies): Official same-org napi-rs platform binary, pinned exact version. | ai | |
| dependencies | unvetted-dep:@node-rs/xxhash-android-arm-eabi | AI (dependencies): Official same-org napi-rs platform binary, pinned exact version. | ai | |
| dependencies | unvetted-dep:@node-rs/xxhash-linux-arm64-musl | AI (dependencies): Official same-org napi-rs platform binary, pinned exact version. | ai | |
| dependencies | unvetted-dep:@node-rs/xxhash-win32-arm64-msvc | AI (dependencies): Official same-org napi-rs platform binary, pinned exact version. | ai | |
| dependencies | unvetted-dep:@node-rs/xxhash-linux-arm-gnueabihf | AI (dependencies): Official same-org napi-rs platform binary, pinned exact version. | ai |
Versions (showing 9 of 9)
| Version | Deps | Published |
|---|---|---|
| 1.7.6 | 0 / 8 | |
| 1.7.4 | 0 / 5 | |
| 1.7.3 | 14 / 5 | |
| 1.7.2 | 14 / 5 | |
| 1.6.2 | 14 / 5 | |
| 1.2.1 | 13 / 4 | |
| 1.1.2 | 0 / 4 | |
| 1.1.1 | 13 / 4 | |
| 1.0.0 | 13 / 4 |
v1.7.6
1 finding
INFO
Has SLSA provenance attestation
provenance
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.7.4
1 finding
INFO
Has SLSA provenance attestation
provenance
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.7.3
1 finding
INFO
Has SLSA provenance attestation
provenance
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v0.2). This is the strongest supply chain integrity signal.
v1.7.2
1 finding
INFO
Has SLSA provenance attestation
provenance
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v0.2). This is the strongest supply chain integrity signal.
v1.6.2
1 finding
INFO
Has SLSA provenance attestation
provenance
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v0.2). This is the strongest supply chain integrity signal.
v1.2.1
1 finding
LOW
No provenance attestation
provenance
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.1.2
1 finding
LOW
No provenance attestation
provenance
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.1.1
1 finding
LOW
No provenance attestation
provenance
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.0
1 finding
LOW
No provenance attestation
provenance
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.