← Home

apache-arrow

npm Repository Homepage

Apache Arrow columnar in-memory format

9
Versions
Apache-2.0
License
No
Install Scripts
Missing
Provenance

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.

Maintainers

ptaylorkouxhochywesmkszucsjorgecarleitaoamoebaraulcd

Keywords

apachearrow

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
semgrep semgrep:new-function-constructor AI (semgrep): Apache Arrow JS uses new Function() to dynamically generate type-validation functions from schema definitions. This is a documented, benign pattern in this codebase, visible in public source. ai
semgrep semgrep:api-obfuscation-reflect AI (semgrep): Reflect.get/set used for implementing Map-like row access in Arrow's columnar data structures — standard ES6 Reflect API usage, not obfuscation. Stable pattern across versions. ai
phantom-deps phantom-dep:@types/node AI (phantom-deps): @types/node is a TypeScript type definition used as a bundled runtime dep in Apache Arrow JS — known pattern for this package. ai
phantom-deps phantom-dep:@swc/helpers AI (phantom-deps): @swc/helpers is a known implicit runtime dependency for SWC-compiled output in Apache Arrow JS. ai
phantom-deps phantom-dep:@types/command-line-args AI (phantom-deps): TypeScript type definitions bundled as runtime deps — known Apache Arrow JS pattern. ai
phantom-deps phantom-dep:@types/command-line-usage AI (phantom-deps): TypeScript type definitions bundled as runtime deps — known Apache Arrow JS pattern. ai

Versions (showing 9 of 9)

Version Deps Published
21.1.0 9 / 0
21.0.0 9 / 0
20.0.0 9 / 0
19.0.1 9 / 0
19.0.0 9 / 0
18.1.0 9 / 0
18.0.0 9 / 0
17.0.0 9 / 0
16.1.0 9 / 0

v21.1.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v21.0.0

2 findings
HIGH Publisher changed: raulcd → kou (on 2025-07-04) provenance

This version was published by a different npm account than previous versions on 2025-07-04. This could indicate a legitimate maintainer transition or an account compromise.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v20.0.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v19.0.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v19.0.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v18.1.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v18.0.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v17.0.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v16.1.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.