@nxtedition/shared
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| publish-pattern | new-deps-added | AI (publish-pattern): Standard native-addon build deps (nan, node-gyp-build) matching binding.gyp setup. | ai | |
| phantom-deps | phantom-dep:nan | AI (phantom-deps): nan is used by native build tooling, not direct JS import. | ai | |
| phantom-deps | phantom-dep:node-gyp | AI (phantom-deps): node-gyp is an implicit build-time dependency for native addons; not directly imported in JS. | ai | |
| install-scripts | install-script:install | AI (install-scripts): Native addon package; node-gyp-build is the standard install pattern for prebuilt binaries. | ai | |
| npm-metadata | bundled-binaries | AI (npm-metadata): Prebuilt .node binary is expected for this native addon; C++ sources are also shipped. | ai | |
| semgrep | semgrep:new-function-constructor | AI (semgrep): Used to wrap dynamic import() to avoid TS static resolution, not arbitrary code execution. | ai |
Versions (showing 24 of 24)
| Version | Deps | Published |
|---|---|---|
| 5.1.14 | 2 / 6 | |
| 5.1.13 | 1 / 7 | |
| 5.1.5 | 1 / 7 | |
| 5.1.3 | 1 / 7 | |
| 5.1.0 | 1 / 7 | |
| 5.0.3 | 2 / 8 | |
| 5.0.2 | 0 / 6 | |
| 5.0.1 | 0 / 6 | |
| 5.0.0 | 0 / 6 | |
| 4.0.8 | 0 / 6 | |
| 4.0.7 | 0 / 6 | |
| 4.0.6 | 0 / 6 | |
| 4.0.5 | 0 / 5 | |
| 4.0.4 | 0 / 5 | |
| 4.0.3 | 0 / 5 | |
| 4.0.2 | 0 / 5 | |
| 4.0.1 | 0 / 5 | |
| 4.0.0 | 0 / 5 | |
| 3.0.2 | 0 / 5 | |
| 3.0.1 | 0 / 5 | |
| 1.0.13 | 0 / 5 | |
| 1.0.12 | 0 / 5 | |
| 1.0.11 | 0 / 5 | |
| 1.0.10 | 0 / 5 |
v5.1.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.0.3
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.0.8
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (qtoden) than the most recent previously approved version (ronag) on 2026-03-11, but qtoden is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.