bower
The browser package manager
7
Versions
MIT
License
No
Install Scripts
Missing
Provenance
Supply chain provenance
Status for the latest visible version.
No SLSA provenance
npm registry signatures
No source commit
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
sheerunsatazor
Keywords
bower
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| provenance | no-provenance | AI (provenance): Bower is a legacy package manager predating Sigstore provenance; absence is expected and not a risk signal here. | ai | |
| source-diff | net-exec-file:lib/node_modules/bower-registry-client/node_modules/ajv/dist/ajv.bundle.js | AI (source-diff): Standard UMD/browserify bundle of ajv JSON Schema validator. The 'network' and 'exec' patterns are UMD boilerplate and new Function() for async transpilation, not malware. | ai | |
| source-diff | net-exec-file:lib/node_modules/bower-registry-client/node_modules/ajv/dist/ajv.min.js | AI (source-diff): Minified UMD bundle of ajv 4.11.8. Same false-positive pattern as the bundle file — UMD wrapper and new Function() for generator support, not dropper/loader malware. | ai | |
| source-diff | obfuscated-file:lib/node_modules/redeyed/node_modules/esprima/esprima.js | AI (source-diff): This is the legitimate esprima JavaScript parser, a well-known open-source library. The 'obfuscation' is standard minification; copyright headers confirm authenticity. Stable false positive for bower. | ai | |
| semgrep | semgrep:dynamic-require | AI (semgrep): bower is a package manager that legitimately uses dynamic require() to load package metadata and plugins; this pattern is expected across all versions. | ai | |
| semgrep | semgrep:child-process-import | AI (semgrep): bower legitimately spawns child processes to run git and other VCS commands; child_process usage is expected and stable across all versions. | ai | |
| semgrep | semgrep:child-process-spawn | AI (semgrep): bower legitimately uses child_process.spawn() to invoke git and other tools; this is core functionality stable across all versions. | ai |