← Home

app-builder-lib

36
Versions
License
No
Install Scripts
Verified
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures No source commit

Maintainers

develaronegoldfishh

Keywords

electronbuilderbuildinstallerinstallpackagerpacknsisappdmgpkgmsiexesetupWindowsOS XMacOSMacappxsnapflatpakportable

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
provenance publisher-changed AI (provenance): Transition to GitHub Actions CI publishing is confirmed by SLSA provenance attestation; expected for this repo. ai
dependencies unvetted-dep:config-file-ts AI (dependencies): config-file-ts has been a stable dependency of this package across many versions; no malicious signals. ai
source-diff obfuscated-file:out/targets/blockmap/blockmap.js AI (source-diff): Long lines are precomputed Int32Array lookup tables for Rabin fingerprinting, not obfuscation. Legitimate algorithmic code. ai
publish-pattern new-deps-added AI (publish-pattern): @electron/get and proper-lockfile are well-known electron-ecosystem packages; no malicious signal. ai
dependencies unvetted-dep:@electron/universal AI (dependencies): Official @electron org package; stable dependency for this build tool. ai
semgrep semgrep:eval-usage AI (semgrep): ESM dynamic import shim via eval('import(...)') — documented CJS/ESM interop pattern for this build tool. ai
semgrep semgrep:env-spread AI (semgrep): Passes env to signing/build tools; expected pattern for electron-builder. ai
phantom-deps phantom-dep:@types/fs-extra AI (phantom-deps): @types package used for TypeScript typings, not a runtime import; stable false positive. ai
semgrep semgrep:dynamic-require AI (semgrep): Plugin/dynamic import loader pattern; documented and stable for this package. ai
semgrep semgrep:child-process-spawn AI (semgrep): Spawns package manager commands for node module collection; expected build-tool behavior. ai
semgrep semgrep:child-process-import AI (semgrep): Build tool that invokes native module compilation; child_process use is inherent. ai
semgrep semgrep:base64-decode AI (semgrep): Decodes base64-encoded code-signing certificates; core functionality of this package. ai

Versions (showing 36 of 36)

Version Deps Published
26.15.3 41 / 32
26.15.2 41 / 32
26.15.1 41 / 32
26.15.0 41 / 32
26.14.0 41 / 32
26.13.1 40 / 32
26.13.0 40 / 32
26.12.1 37 / 32
26.12.0 37 / 32
26.11.1 37 / 32
26.11.0 37 / 32
26.10.0 37 / 32
26.9.1 36 / 31
26.9.0 36 / 31
26.8.2 36 / 31
26.8.1 36 / 31
26.8.0 36 / 31
26.7.0 36 / 31
26.6.0 36 / 31
26.5.0 34 / 30
26.4.1 34 / 31
26.4.0 34 / 31
26.3.6 34 / 31
26.3.5 34 / 31
26.3.4 34 / 31
26.3.3 34 / 31
26.3.2 34 / 31
26.3.1 34 / 31
26.3.0 34 / 31
26.2.0 34 / 31
26.1.0 34 / 31
26.0.20 34 / 31
26.0.19 34 / 31
26.0.18 34 / 31
26.0.17 34 / 31
26.0.16 33 / 30

v26.15.3

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v26.15.2

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v26.15.1

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v26.15.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v26.14.0

2 findings
HIGH New obfuscated file: out/targets/blockmap/blockmap.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v26.13.1

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v26.13.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v26.12.1

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v26.12.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v26.11.1

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v26.11.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v26.10.0

7 findings
HIGH env-spread: out/codeSign/windowsSignToolManager.js:358 semgrep

Spreading entire process.env into an object — may capture all secrets 356 | args = configuration.computeSignToolArgs(isWin); 357 | } > 358 | await (0, builder_util_1.retry)(() => vm.exec(tool, args, { timeout, env: { ...process.env, ...(toolInfo.env || 359 | retries: 2, 360 | interval: 15000,

HIGH env-spread: out/node-module-collector/nodeModulesCollector.js:333 semgrep

Spreading entire process.env into an object — may capture all secrets 331 | const child = childProcess.spawn(command, args, { 332 | cwd, > 333 | env: { COREPACK_ENABLE_STRICT: "0", ...process.env }, // allow `process.env` overrides 334 | shell: true, // `true`` is required: https://github.com/electron-userland/electron-builder/issues/9488 335 | });

HIGH env-spread: out/targets/FpmTarget.js:205 semgrep

Spreading entire process.env into an object — may capture all secrets 203 | return; 204 | } > 205 | const env = { 206 | ...process.env, 207 | };

HIGH env-spread: out/targets/nsis/NsisTarget.js:544 semgrep

Spreading entire process.env into an object — may capture all secrets 542 | await (0, builder_util_1.spawnAndWrite)(command, args, script, { 543 | // we use NSIS_CONFIG_CONST_DATA_PATH=no to build makensis on Linux, but in any case it doesn't use stubs as > 544 | env: { ...process.env, NSISDIR: nsisPath }, 545 | cwd: nsisUtil_1.nsisTemplatesDir, 546 | });

HIGH env-spread: out/util/bundledTool.js:14 semgrep

Spreading entire process.env into an object — may capture all secrets 12 | function computeToolEnv(libPath) { 13 | // noinspection SpellCheckingInspection > 14 | return { 15 | ...process.env, 16 | DYLD_LIBRARY_PATH: computeEnv(process.env.DYLD_LIBRARY_PATH, libPath),

HIGH env-spread: out/util/yarn.js:43 semgrep

Spreading entire process.env into an object — may capture all secrets 41 | function getGypEnv(frameworkInfo, platform, arch, buildFromSource) { 42 | const npmConfigArch = arch === "armv7l" ? "arm" : arch; > 43 | const common = { 44 | ...process.env, 45 | npm_config_arch: npmConfigArch,

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v26.9.1

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v26.9.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v26.8.2

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v26.8.1

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v26.8.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v26.7.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v26.6.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v26.5.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v26.4.1

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v26.4.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v26.3.6

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v26.3.5

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v26.3.4

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v26.3.3

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v26.3.2

5 findings
HIGH env-spread: out/targets/FpmTarget.js:205 semgrep

Spreading entire process.env into an object — may capture all secrets 203 | return; 204 | } > 205 | const env = { 206 | ...process.env, 207 | };

HIGH env-spread: out/targets/nsis/NsisTarget.js:544 semgrep

Spreading entire process.env into an object — may capture all secrets 542 | await (0, builder_util_1.spawnAndWrite)(command, args, script, { 543 | // we use NSIS_CONFIG_CONST_DATA_PATH=no to build makensis on Linux, but in any case it doesn't use stubs as > 544 | env: { ...process.env, NSISDIR: nsisPath }, 545 | cwd: nsisUtil_1.nsisTemplatesDir, 546 | });

HIGH env-spread: out/util/bundledTool.js:14 semgrep

Spreading entire process.env into an object — may capture all secrets 12 | function computeToolEnv(libPath) { 13 | // noinspection SpellCheckingInspection > 14 | return { 15 | ...process.env, 16 | DYLD_LIBRARY_PATH: computeEnv(process.env.DYLD_LIBRARY_PATH, libPath),

HIGH env-spread: out/util/yarn.js:42 semgrep

Spreading entire process.env into an object — may capture all secrets 40 | function getGypEnv(frameworkInfo, platform, arch, buildFromSource) { 41 | const npmConfigArch = arch === "armv7l" ? "arm" : arch; > 42 | const common = { 43 | ...process.env, 44 | npm_config_arch: npmConfigArch,

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v26.3.1

5 findings
HIGH env-spread: out/targets/FpmTarget.js:205 semgrep

Spreading entire process.env into an object — may capture all secrets 203 | return; 204 | } > 205 | const env = { 206 | ...process.env, 207 | };

HIGH env-spread: out/targets/nsis/NsisTarget.js:544 semgrep

Spreading entire process.env into an object — may capture all secrets 542 | await (0, builder_util_1.spawnAndWrite)(command, args, script, { 543 | // we use NSIS_CONFIG_CONST_DATA_PATH=no to build makensis on Linux, but in any case it doesn't use stubs as > 544 | env: { ...process.env, NSISDIR: nsisPath }, 545 | cwd: nsisUtil_1.nsisTemplatesDir, 546 | });

HIGH env-spread: out/util/bundledTool.js:14 semgrep

Spreading entire process.env into an object — may capture all secrets 12 | function computeToolEnv(libPath) { 13 | // noinspection SpellCheckingInspection > 14 | return { 15 | ...process.env, 16 | DYLD_LIBRARY_PATH: computeEnv(process.env.DYLD_LIBRARY_PATH, libPath),

HIGH env-spread: out/util/yarn.js:42 semgrep

Spreading entire process.env into an object — may capture all secrets 40 | function getGypEnv(frameworkInfo, platform, arch, buildFromSource) { 41 | const npmConfigArch = arch === "armv7l" ? "arm" : arch; > 42 | const common = { 43 | ...process.env, 44 | npm_config_arch: npmConfigArch,

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v26.3.0

2 findings
HIGH Publisher changed: onegoldfishh → GitHub Actions (on 2025-11-18) provenance

This version was published by a different npm account than previous versions on 2025-11-18. This could indicate a legitimate maintainer transition or an account compromise.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v26.2.0

2 findings
HIGH Publisher changed: onegoldfishh → GitHub Actions (on 2025-11-15) provenance

This version was published by a different npm account than previous versions on 2025-11-15. This could indicate a legitimate maintainer transition or an account compromise.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v26.1.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v26.0.20

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v26.0.19

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v26.0.18

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v26.0.17

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v26.0.16

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.