@reboot-dev/reboot
npm package for Reboot
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| install-scripts | install-script:preinstall | AI (install-scripts): Native addon build tool; preinstall.cjs is part of documented build flow across all versions. | ai | |
| install-scripts | install-script:install | AI (install-scripts): install.cjs drives native gyp compilation; consistent with gypfile:true and reboot_native.cc. | ai | |
| install-scripts | install-script:postinstall | AI (install-scripts): Runs bundled rbt binary with || exit 0 fallback; benign for a CLI tool package. | ai | |
| semgrep | semgrep:env-spread | AI (semgrep): Spreading process.env when forking a subprocess is standard practice for CLI tools passing environment to child processes. | ai | |
| semgrep | semgrep:child-process-import | AI (semgrep): install.cjs uses execSync for native build steps; expected in a gyp-based native addon. | ai | |
| phantom-deps | phantom-dep:node-gyp | AI (phantom-deps): node-gyp is a known implicit build dependency; phantom-dep false positive for native addons. | ai | |
| phantom-deps | phantom-dep:tsx | AI (phantom-deps): tsx referenced in config files; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:uuid | AI (phantom-deps): uuid referenced in config files; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:@scarf/scarf | AI (phantom-deps): scarf referenced in config; stable false positive. | ai | |
| phantom-deps | phantom-dep:extensionless | AI (phantom-deps): Referenced in config files; stable false positive. | ai | |
| phantom-deps | phantom-dep:node-addon-api | AI (phantom-deps): node-addon-api is a native build dependency used implicitly via gyp; stable false positive. | ai | |
| phantom-deps | phantom-dep:@bufbuild/protoplugin | AI (phantom-deps): protoplugin used via config/bin invocation; stable false positive. | ai |
Versions (showing 1 of 1)
| Version | Deps | Published |
|---|---|---|
| 0.39.2 | 16 / 5 |
v0.39.2
6 findingsScript: node preinstall.cjs
Script: rbt || exit 0
Script: node install.cjs
Spreading entire process.env into an object — may capture all secrets 893 | // server subprocess. 894 | const subprocess = fork(process.argv[1], { > 895 | env: { 896 | ...process.env, 897 | // Pass over the server args in an env var.
Spreading entire process.env into an object — may capture all secrets 18 | .readFileSync(".reboot_python_env", "utf8") 19 | .trim(); > 20 | const env = { 21 | ...process.env, 22 | CC: process.env.CC || fs.readFileSync(".reboot_cc_env", "utf8").trim(),
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.