@stoprocent/noble
Supply chain provenance
Status for the latest visible version.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| dependencies | unvetted-dep:node-gyp-build | AI (dependencies): node-gyp-build is the standard prebuilt-binary loader for native Node.js addons; expected for this package. | ai | |
| install-scripts | install-script:install | AI (install-scripts): node-gyp-build is the standard prebuilt binary loader for native addons; stable for this package. | ai | |
| npm-metadata | bundled-binaries | AI (npm-metadata): Prebuilt .node files for multiple platforms are expected for this native BLE addon; matches documented prebuildify workflow. | ai | |
| semgrep | semgrep:hex-decode | AI (semgrep): Hex literals are BLE SMP protocol constants (zeroed STK/diversifier buffers), not obfuscated payloads. | ai | |
| phantom-deps | phantom-dep:patch-package | AI (phantom-deps): patch-package is used in the prebuildify-cross build script, not imported at runtime. | ai | |
| phantom-deps | phantom-dep:node-addon-api | AI (phantom-deps): node-addon-api is a native build-time dependency referenced in binding.gyp, not imported via require(). | ai |
Versions (showing 4 of 4)
| Version | Deps | Published |
|---|---|---|
| 2.4.1 | 4 / 26 | |
| 2.3.18 | 4 / 25 | |
| 2.3.13 | 4 / 25 | |
| 2.3.7 | 3 / 25 |
v2.4.1
3 findingsScript: node-gyp-build
Package contains compiled binaries that could be backdoors: • prebuilds/linux-arm/@stoprocent+noble.armv6.node • prebuilds/android-arm/@stoprocent+noble.armv7.node • prebuilds/linux-arm/@stoprocent+noble.armv7.node • prebuilds/android-arm64/@stoprocent+noble.armv8.node • prebuilds/linux-arm64/@stoprocent+noble.armv8.node • prebuilds/linux-x64/@stoprocent+noble.glibc.node • prebuilds/linux-x64/@stoprocent+noble.musl.node • prebuilds/win32-ia32/@stoprocent+noble.node • prebuilds/win32-x64/@stoprocent+noble.node
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v2.3.13
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.3.7
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.