@reboot-dev/reboot
npm package for Reboot
1
Versions
Apache-2.0
License
Yes
Install Scripts
Missing
Provenance
Supply chain provenance
Status for the latest visible version.
No SLSA provenance
npm registry signatures
No source commit
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
rjhuijsmanreboot-benhreboot-stuhoodreboot-rileyonelxjaldipower
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| install-scripts | install-script:preinstall | AI (install-scripts): Native addon build tool; preinstall.cjs is part of documented build flow across all versions. | ai | |
| install-scripts | install-script:install | AI (install-scripts): install.cjs drives native gyp compilation; consistent with gypfile:true and reboot_native.cc. | ai | |
| install-scripts | install-script:postinstall | AI (install-scripts): Runs bundled rbt binary with || exit 0 fallback; benign for a CLI tool package. | ai | |
| semgrep | semgrep:env-spread | AI (semgrep): Spreading process.env when forking a subprocess is standard practice for CLI tools passing environment to child processes. | ai | |
| semgrep | semgrep:child-process-import | AI (semgrep): install.cjs uses execSync for native build steps; expected in a gyp-based native addon. | ai | |
| phantom-deps | phantom-dep:node-gyp | AI (phantom-deps): node-gyp is a known implicit build dependency; phantom-dep false positive for native addons. | ai | |
| phantom-deps | phantom-dep:tsx | AI (phantom-deps): tsx referenced in config files; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:uuid | AI (phantom-deps): uuid referenced in config files; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:@scarf/scarf | AI (phantom-deps): scarf referenced in config; stable false positive. | ai | |
| phantom-deps | phantom-dep:extensionless | AI (phantom-deps): Referenced in config files; stable false positive. | ai | |
| phantom-deps | phantom-dep:node-addon-api | AI (phantom-deps): node-addon-api is a native build dependency used implicitly via gyp; stable false positive. | ai | |
| phantom-deps | phantom-dep:@bufbuild/protoplugin | AI (phantom-deps): protoplugin used via config/bin invocation; stable false positive. | ai |
Versions (showing 1 of 1)
| Version | Deps | Published |
|---|---|---|
| 0.39.2 | 16 / 5 |