app-builder-lib
Supply chain provenance
Status for the latest visible version.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| provenance | publisher-changed | AI (provenance): Transition to GitHub Actions CI publishing is confirmed by SLSA provenance attestation; expected for this repo. | ai | |
| dependencies | unvetted-dep:config-file-ts | AI (dependencies): config-file-ts has been a stable dependency of this package across many versions; no malicious signals. | ai | |
| source-diff | obfuscated-file:out/targets/blockmap/blockmap.js | AI (source-diff): Long lines are precomputed Int32Array lookup tables for Rabin fingerprinting, not obfuscation. Legitimate algorithmic code. | ai | |
| publish-pattern | new-deps-added | AI (publish-pattern): @electron/get and proper-lockfile are well-known electron-ecosystem packages; no malicious signal. | ai | |
| dependencies | unvetted-dep:@electron/universal | AI (dependencies): Official @electron org package; stable dependency for this build tool. | ai | |
| semgrep | semgrep:eval-usage | AI (semgrep): ESM dynamic import shim via eval('import(...)') — documented CJS/ESM interop pattern for this build tool. | ai | |
| semgrep | semgrep:env-spread | AI (semgrep): Passes env to signing/build tools; expected pattern for electron-builder. | ai | |
| phantom-deps | phantom-dep:@types/fs-extra | AI (phantom-deps): @types package used for TypeScript typings, not a runtime import; stable false positive. | ai | |
| semgrep | semgrep:dynamic-require | AI (semgrep): Plugin/dynamic import loader pattern; documented and stable for this package. | ai | |
| semgrep | semgrep:child-process-spawn | AI (semgrep): Spawns package manager commands for node module collection; expected build-tool behavior. | ai | |
| semgrep | semgrep:child-process-import | AI (semgrep): Build tool that invokes native module compilation; child_process use is inherent. | ai | |
| semgrep | semgrep:base64-decode | AI (semgrep): Decodes base64-encoded code-signing certificates; core functionality of this package. | ai |
Versions (showing 36 of 36)
| Version | Deps | Published |
|---|---|---|
| 26.15.3 | 41 / 32 | |
| 26.15.2 | 41 / 32 | |
| 26.15.1 | 41 / 32 | |
| 26.15.0 | 41 / 32 | |
| 26.14.0 | 41 / 32 | |
| 26.13.1 | 40 / 32 | |
| 26.13.0 | 40 / 32 | |
| 26.12.1 | 37 / 32 | |
| 26.12.0 | 37 / 32 | |
| 26.11.1 | 37 / 32 | |
| 26.11.0 | 37 / 32 | |
| 26.10.0 | 37 / 32 | |
| 26.9.1 | 36 / 31 | |
| 26.9.0 | 36 / 31 | |
| 26.8.2 | 36 / 31 | |
| 26.8.1 | 36 / 31 | |
| 26.8.0 | 36 / 31 | |
| 26.7.0 | 36 / 31 | |
| 26.6.0 | 36 / 31 | |
| 26.5.0 | 34 / 30 | |
| 26.4.1 | 34 / 31 | |
| 26.4.0 | 34 / 31 | |
| 26.3.6 | 34 / 31 | |
| 26.3.5 | 34 / 31 | |
| 26.3.4 | 34 / 31 | |
| 26.3.3 | 34 / 31 | |
| 26.3.2 | 34 / 31 | |
| 26.3.1 | 34 / 31 | |
| 26.3.0 | 34 / 31 | |
| 26.2.0 | 34 / 31 | |
| 26.1.0 | 34 / 31 | |
| 26.0.20 | 34 / 31 | |
| 26.0.19 | 34 / 31 | |
| 26.0.18 | 34 / 31 | |
| 26.0.17 | 34 / 31 | |
| 26.0.16 | 33 / 30 |
v26.15.3
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v26.15.2
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v26.15.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v26.15.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v26.14.0
2 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v26.13.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v26.13.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v26.12.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v26.12.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v26.11.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v26.11.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v26.10.0
7 findingsSpreading entire process.env into an object — may capture all secrets 356 | args = configuration.computeSignToolArgs(isWin); 357 | } > 358 | await (0, builder_util_1.retry)(() => vm.exec(tool, args, { timeout, env: { ...process.env, ...(toolInfo.env || 359 | retries: 2, 360 | interval: 15000,
Spreading entire process.env into an object — may capture all secrets 331 | const child = childProcess.spawn(command, args, { 332 | cwd, > 333 | env: { COREPACK_ENABLE_STRICT: "0", ...process.env }, // allow `process.env` overrides 334 | shell: true, // `true`` is required: https://github.com/electron-userland/electron-builder/issues/9488 335 | });
Spreading entire process.env into an object — may capture all secrets 203 | return; 204 | } > 205 | const env = { 206 | ...process.env, 207 | };
Spreading entire process.env into an object — may capture all secrets 542 | await (0, builder_util_1.spawnAndWrite)(command, args, script, { 543 | // we use NSIS_CONFIG_CONST_DATA_PATH=no to build makensis on Linux, but in any case it doesn't use stubs as > 544 | env: { ...process.env, NSISDIR: nsisPath }, 545 | cwd: nsisUtil_1.nsisTemplatesDir, 546 | });
Spreading entire process.env into an object — may capture all secrets 12 | function computeToolEnv(libPath) { 13 | // noinspection SpellCheckingInspection > 14 | return { 15 | ...process.env, 16 | DYLD_LIBRARY_PATH: computeEnv(process.env.DYLD_LIBRARY_PATH, libPath),
Spreading entire process.env into an object — may capture all secrets 41 | function getGypEnv(frameworkInfo, platform, arch, buildFromSource) { 42 | const npmConfigArch = arch === "armv7l" ? "arm" : arch; > 43 | const common = { 44 | ...process.env, 45 | npm_config_arch: npmConfigArch,
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v26.9.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v26.9.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v26.8.2
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v26.8.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v26.8.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v26.7.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v26.6.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v26.5.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v26.4.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v26.4.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v26.3.6
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v26.3.5
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v26.3.4
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v26.3.3
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v26.3.2
5 findingsSpreading entire process.env into an object — may capture all secrets 203 | return; 204 | } > 205 | const env = { 206 | ...process.env, 207 | };
Spreading entire process.env into an object — may capture all secrets 542 | await (0, builder_util_1.spawnAndWrite)(command, args, script, { 543 | // we use NSIS_CONFIG_CONST_DATA_PATH=no to build makensis on Linux, but in any case it doesn't use stubs as > 544 | env: { ...process.env, NSISDIR: nsisPath }, 545 | cwd: nsisUtil_1.nsisTemplatesDir, 546 | });
Spreading entire process.env into an object — may capture all secrets 12 | function computeToolEnv(libPath) { 13 | // noinspection SpellCheckingInspection > 14 | return { 15 | ...process.env, 16 | DYLD_LIBRARY_PATH: computeEnv(process.env.DYLD_LIBRARY_PATH, libPath),
Spreading entire process.env into an object — may capture all secrets 40 | function getGypEnv(frameworkInfo, platform, arch, buildFromSource) { 41 | const npmConfigArch = arch === "armv7l" ? "arm" : arch; > 42 | const common = { 43 | ...process.env, 44 | npm_config_arch: npmConfigArch,
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v26.3.1
5 findingsSpreading entire process.env into an object — may capture all secrets 203 | return; 204 | } > 205 | const env = { 206 | ...process.env, 207 | };
Spreading entire process.env into an object — may capture all secrets 542 | await (0, builder_util_1.spawnAndWrite)(command, args, script, { 543 | // we use NSIS_CONFIG_CONST_DATA_PATH=no to build makensis on Linux, but in any case it doesn't use stubs as > 544 | env: { ...process.env, NSISDIR: nsisPath }, 545 | cwd: nsisUtil_1.nsisTemplatesDir, 546 | });
Spreading entire process.env into an object — may capture all secrets 12 | function computeToolEnv(libPath) { 13 | // noinspection SpellCheckingInspection > 14 | return { 15 | ...process.env, 16 | DYLD_LIBRARY_PATH: computeEnv(process.env.DYLD_LIBRARY_PATH, libPath),
Spreading entire process.env into an object — may capture all secrets 40 | function getGypEnv(frameworkInfo, platform, arch, buildFromSource) { 41 | const npmConfigArch = arch === "armv7l" ? "arm" : arch; > 42 | const common = { 43 | ...process.env, 44 | npm_config_arch: npmConfigArch,
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v26.3.0
2 findingsThis version was published by a different npm account than previous versions on 2025-11-18. This could indicate a legitimate maintainer transition or an account compromise.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v26.2.0
2 findingsThis version was published by a different npm account than previous versions on 2025-11-15. This could indicate a legitimate maintainer transition or an account compromise.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v26.1.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v26.0.20
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v26.0.19
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v26.0.18
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v26.0.17
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v26.0.16
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.