@pact-foundation/pact-core-linux-arm64-musl MIT 2 versions

@pact-foundation/pact-core-linux-arm64-musl

npm Repository Homepage

Platform/arch specific libpact_ffi binaries for @pact-foundation/pact-core

Versions

MIT

License

Install Scripts

Verified

Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures gitHead linked

mefellows-pactyou54fmfellows

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
npm-metadata	bundled-binaries	AI (npm-metadata): Package's sole purpose is distributing prebuilt pact_ffi native binaries for linux-arm64-musl; SLSA provenance attestation confirms integrity.	ai	2026/05/06

Version	Deps	Published
20.0.0	0 / 0	2026-05-29
19.2.0	0 / 0	2026-05-01

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

2 findings

HIGH Bundled binary files (2) npm-metadata

Package contains compiled binaries that could be backdoors: • prebuilds/linux-arm64/node.napi.musl.node • prebuilds/linux-arm64/libpact_ffi_musl.so

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.