@sap/hana-client
Official SAP HANA Node.js Driver
7
Versions
SEE LICENSE IN developer-license-3_2.txt
License
Yes
Install Scripts
Missing
Provenance
Supply chain provenance
Status for the latest visible version.
No SLSA provenance
npm registry signatures
No source commit
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
sap_extncrepossap-ospo-admin
Keywords
SAPHANAclientin-memorydatabaseSQLbusinessapplicationintelligententerprisecloudanalyticsexperience
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| maintainer-change | maintainer-added | AI (maintainer-change): sap-ospo-admin is SAP's OSS admin account; expected for this official SAP package. | ai | |
| semgrep | semgrep:eval-usage | AI (semgrep): eval() in Stream.js is used for dynamic dispatch in stream handling, consistent with a database driver's legitimate parsing logic. Stable pattern across versions of this SAP package. | ai | |
| provenance | no-provenance | AI (provenance): SAP's enterprise npm publishing pipeline does not use Sigstore attestation; publisher identity is well-established with 58 approved packages. | ai | |
| install-scripts | install-script:install | AI (install-scripts): checkbuild.js is the standard install script for this native HANA client driver; it selects the correct prebuilt binary for the platform. Stable across all versions. | ai | |
| semgrep | semgrep:dynamic-require | AI (semgrep): Dynamic require resolves a local path (__dirname/lib/index) for platform-specific binary loading. Not arbitrary code loading; stable pattern for this package. | ai | |
| npm-metadata | bundled-binaries | AI (npm-metadata): Prebuilt .node binaries for multiple platforms are the documented distribution mechanism for the SAP HANA Node.js driver. Expected and stable across all versions. | ai | |
| semgrep | semgrep:child-process-import | AI (semgrep): child_process is used only to run 'ldd --version' to detect musl libc for binary selection. Benign and stable pattern for this package. | ai |