botbuilder — Greenflagged

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures No source commit

Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.

Maintainers

botframeworksgellockcwhitten

Keywords

botbuilderbotframeworkbotschatbots

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
semgrep	semgrep:api-obfuscation-reflect	AI (semgrep): Reflect.get() usage is in vendors/chai/chai.js — a vendored copy of the Chai assertion library used for testing. This is legitimate proxy-based assertion chaining, not malicious API obfuscation.	ai	2026/04/25
dependencies	unvetted-dep:botbuilder-core	AI (dependencies): First-party Microsoft Bot Framework sibling package pinned to the same release version; expected monorepo dependency.	ai	2026/04/25
dependencies	unvetted-dep:botbuilder-stdlib	AI (dependencies): First-party Microsoft Bot Framework internal sibling package; expected monorepo dependency.	ai	2026/04/25
dependencies	unvetted-dep:botframework-schema	AI (dependencies): First-party Microsoft Bot Framework sibling package pinned to the same release version; expected monorepo dependency.	ai	2026/04/25
dependencies	unvetted-dep:botframework-connector	AI (dependencies): First-party Microsoft Bot Framework sibling package pinned to the same release version; expected monorepo dependency.	ai	2026/04/25
dependencies	unvetted-dep:botframework-streaming	AI (dependencies): First-party Microsoft Bot Framework sibling package pinned to the same release version; expected monorepo dependency.	ai	2026/04/25

Versions (showing 1 of 1)

Version	Deps	Published
4.23.3	14 / 6	2025-08-27

v4.23.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.