@ossiana/node-libcurl
## Different with Nodejs fetch api * The fingerprint can be customized to look like chrome or firefox ,it modified the BoringSSL extension, set the custom cipher suite with Libcurl ------------
2
Versions
MIT
License
Yes
Install Scripts
Verified
Provenance
Supply chain provenance
Status for the latest visible version.
SLSA provenance attestation
npm registry signatures
gitHead linked
Maintainers
ossiana
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| install-scripts | install-script:install | AI (install-scripts): Install script is a no-op colon command; not executable code. | ai | |
| semgrep | semgrep:child-process-execsync | AI (semgrep): execSync used only to locate ldd binary; standard native addon detection pattern. | ai | |
| semgrep | semgrep:child-process-import | AI (semgrep): child_process import is for ldd detection in postinstall; benign native binding pattern. | ai | |
| phantom-deps | phantom-dep:node-addon-api | AI (phantom-deps): node-addon-api is a build-time native addon dependency; not directly imported in JS but used in native compilation. | ai |
v1.8.8
2 findings
HIGH
Package has 'install' script
install-scripts
Script: :
INFO
Has SLSA provenance attestation
provenance
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.