@pact-foundation/pact-core-windows-x64 MIT 2 versions

@pact-foundation/pact-core-windows-x64

npm Repository Homepage

Platform/arch specific libpact_ffi binaries for @pact-foundation/pact-core

Versions

MIT

License

Install Scripts

Verified

Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures gitHead linked

mefellows-pactyou54fmfellows

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
npm-metadata	bundled-binaries	AI (npm-metadata): Intentional prebuilt native binaries (pact_ffi.dll + napi node) for a platform-specific FFI package; SLSA provenance confirms CI/CD origin.	ai	2026/05/06

Version	Deps	Published
20.0.0	0 / 0	2026-05-29
19.2.0	0 / 0	2026-05-01

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

2 findings

HIGH Bundled binary files (2) npm-metadata

Package contains compiled binaries that could be backdoors: • prebuilds/win32-x64/pact_ffi.dll • prebuilds/win32-x64/node.napi.node

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.