← Home

chrome-devtools-frontend

npm Repository Homepage
100
Versions
—
License
No
Install Scripts
Attested
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation (unverified) npm registry signatures gitHead linked

Maintainers

paulirishmathiasgoogle-wombot

Keywords

devtoolschromechromiumblinkdebugger

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
semgrep semgrep:toplevel-fetch AI (semgrep): Loads local trace fixture via import.meta.url in a docs demo; no remote destination. ai
vendored-integrity tampered-vendored-dep:front_end/third_party/intl-messageformat/package AI (vendored-integrity): DevTools patches its pinned third_party trees; expected divergence, no payload. ai
vendored-integrity tampered-vendored-dep:front_end/third_party/marked/package AI (vendored-integrity): Only differing file is LICENSE.md; license edit in an official Chromium vendored tree, not a payload. ai
install-scripts install-script:preinstall AI (install-scripts): Preinstall is a guard that echoes/exits; no arbitrary execution. Stable across versions. ai
npm-metadata bundled-binaries AI (npm-metadata): wasm_source_map binding is part of official DevTools; stable across versions. ai
semgrep semgrep:child-process-exec AI (semgrep): Local dev script launching Chrome for testing, not a network payload. ai
vendored-integrity tampered-vendored-dep:front_end/third_party/codemirror/package AI (vendored-integrity): Chromium-patched vendored codemirror fork; stable across versions. ai
vendored-integrity tampered-vendored-dep:front_end/third_party/web-vitals/package AI (vendored-integrity): Chromium-patched vendored web-vitals fork; stable across versions. ai
vendored-integrity tampered-vendored-dep:front_end/third_party/puppeteer/package AI (vendored-integrity): Chromium maintains patched forks of third_party deps; expected divergence in DevTools tree. ai
bogus-package bogus-package AI (bogus-package): Chromium release semver + README are expected for this official mirror. ai
install-scripts install-script:install AI (install-scripts): node-gyp rebuild native build; standard for this package. ai
semgrep semgrep:etc-passwd-access AI (semgrep): String appears in a comment explaining a security mitigation, not actual file access. ai
semgrep semgrep:child-process-spawn AI (semgrep): Spawns blink test runner in test script; expected for a devtools frontend package. ai
provenance no-provenance AI (provenance): Established package with 2160 versions; lack of Sigstore provenance is common and not a risk signal here. ai
semgrep semgrep:api-obfuscation-reflect AI (semgrep): Reflect.get() used as a standard Proxy trap in DWARF debugger extension — not obfuscation. ai
semgrep semgrep:eval-usage AI (semgrep): eval() is in legacy test runner code evaluating test expressions — not runtime production code. ai
semgrep semgrep:child-process-import AI (semgrep): child_process used in scripts/npm_test.js to run blink tests — standard build/test tooling. ai
semgrep semgrep:shady-links-raw-ip AI (semgrep): Raw IPs appear only in unit test fixtures (localhost/127.0.0.1), not production network calls. ai
source-diff obfuscated-file:front_end/third_party/lit/lib/async-directive.js AI (source-diff): Minified Lit HTML library (Google LLC, BSD-3-Clause) bundled as a third-party dependency in Chrome DevTools Frontend. Minification is expected for this package's third-party vendored assets. ai
semgrep semgrep:dynamic-require AI (semgrep): Fires in CodeMirror's loadmode.js addon, which legitimately uses dynamic require to load syntax modes on demand. Well-known, documented behavior. ai
semgrep semgrep:shady-links-tlds AI (semgrep): Fires in third-party-web data catalog listing known ad/analytics domains (e.g. marketingplatform.google.com). These are legitimate reference URLs in a data file, not C2 infrastructure. ai
semgrep semgrep:base64-decode AI (semgrep): Fires in Lighthouse report bundle; base64 usage is for legitimate report rendering (SVG/template content), not payload obfuscation. ai
semgrep semgrep:new-function-constructor AI (semgrep): Fires in bundled axe-core and other third-party libs; new Function() is a documented pattern in axe-core's rule engine. Not a security risk in this package. ai

Versions (showing 100 of 2182)

Version Deps Published
1.0.1667564 0 / 56
1.0.1666631 0 / 56
1.0.1665921 0 / 56
1.0.1664619 0 / 56
1.0.1662965 0 / 56
1.0.1662289 0 / 56
1.0.1661063 0 / 56
1.0.1660788 0 / 56
1.0.1657855 0 / 57
1.0.1657110 0 / 57
1.0.1656897 0 / 57
1.0.1656291 0 / 57
1.0.1654411 0 / 57
1.0.1652307 0 / 57
1.0.1651641 0 / 57
1.0.1650677 0 / 57
1.0.1650232 0 / 58
1.0.1650100 0 / 58
1.0.1650035 0 / 58
1.0.1646714 0 / 58
1.0.1645245 0 / 58
1.0.1643099 0 / 58
1.0.1642899 0 / 58
1.0.1642845 0 / 58
1.0.1642246 0 / 58
1.0.1640841 0 / 58
1.0.1640418 0 / 58
1.0.1636056 0 / 60
1.0.1635876 0 / 62
1.0.1635648 0 / 62
1.0.1632065 0 / 62
1.0.1631386 0 / 62
1.0.1630574 0 / 62
1.0.1630364 0 / 62
1.0.1629211 0 / 62
1.0.1626840 0 / 62
1.0.1622369 0 / 62
1.0.1621678 0 / 62
1.0.1618066 0 / 62
1.0.1616061 0 / 62
1.0.1615539 0 / 62
1.0.1614363 0 / 62
1.0.1613625 0 / 62
1.0.1613465 0 / 62
1.0.1611825 0 / 62
1.0.1611390 0 / 62
1.0.1611099 0 / 62
1.0.1609381 0 / 62
1.0.1608868 0 / 62
1.0.1608453 0 / 62
1.0.1606789 0 / 62
1.0.1605390 0 / 62
1.0.1605219 0 / 62
1.0.1604514 0 / 62
1.0.1603822 0 / 62
1.0.1602543 0 / 62
1.0.1602348 0 / 62
1.0.1601661 0 / 62
1.0.1599001 0 / 62
1.0.1598808 0 / 62
1.0.1597624 0 / 62
1.0.1597448 0 / 62
1.0.1596535 0 / 62
1.0.1596260 0 / 62
1.0.1595925 0 / 62
1.0.1595090 0 / 62
1.0.1593959 0 / 62
1.0.1593518 0 / 62
1.0.1592362 0 / 62
1.0.1592129 0 / 62
1.0.1591204 0 / 62
1.0.1590494 0 / 62
1.0.1589336 0 / 62
1.0.1588580 0 / 62
1.0.1587905 0 / 62
1.0.1587572 0 / 62
1.0.1586699 0 / 62
1.0.1585664 0 / 62
1.0.1585538 0 / 62
1.0.1583146 0 / 62
1.0.1582745 0 / 62
1.0.1581708 0 / 62
1.0.1581449 0 / 62
1.0.1579812 0 / 62
1.0.1578729 0 / 62
1.0.1578486 0 / 62
1.0.1577886 0 / 62
1.0.1576915 0 / 62
1.0.1576287 0 / 62
1.0.1575635 0 / 62
1.0.1575174 0 / 62
1.0.1574367 0 / 62
1.0.1573331 0 / 61
1.0.1572937 0 / 61
1.0.1571573 0 / 61
1.0.1571007 0 / 61
1.0.1570343 0 / 61
1.0.1569477 0 / 61
1.0.1568864 0 / 61
1.0.1568190 0 / 61
Showing 100 of 2182 Next page →

v1.0.1667564

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.0.1666631

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.0.1665921

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.0.1664619

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.0.1662965

4 findings
HIGH Modified vendored dependency: front_end/third_party/puppeteer/package (2 file(s)) vendored-integrity

The directory `front_end/third_party/puppeteer/package` byte-matched 910 of 912 file(s) against [email protected] — a version that passed review and that we hold in storage — which identifies it as a vendored copy of that package. But 2 file(s) inside it differ from that package's bytes at the same path: front_end/third_party/puppeteer/package/lib/es5-iife/puppeteer-core-browser.js, front_end/third_party/puppeteer/package/lib/third_party/urlpattern-polyfill/urlpattern-polyfill.js. A vendored library that is a faithful copy except for a handful of altered files is a well-worn supply-chain shape — the surrounding real code lends the tree legitimacy while the altered files carry the payload. These files are NOT exempt from any authorship heuristic; diff them against [email protected] before greenflagging.

HIGH Modified vendored dependency: front_end/third_party/codemirror/package (33 file(s)) vendored-integrity

The directory `front_end/third_party/codemirror/package` byte-matched 299 of 364 file(s) against [email protected] — a version that passed review and that we hold in storage — which identifies it as a vendored copy of that package. But 33 file(s) inside it differ from that package's bytes at the same path: front_end/third_party/codemirror/package/addon/fold/foldgutter.css, front_end/third_party/codemirror/package/mode/wast/wast.js, front_end/third_party/codemirror/package/src/addon/runmode/codemirror-standalone.js, front_end/third_party/codemirror/package/src/addon/runmode/codemirror.node.js, front_end/third_party/codemirror/package/src/display/focus.js, front_end/third_party/codemirror/package/src/display/gutters.js, front_end/third_party/codemirror/package/src/display/operations.js, front_end/third_party/codemirror/package/src/display/scroll_events.js, front_end/third_party/codemirror/package/src/display/scrollbars.js, front_end/third_party/codemirror/package/src/display/update_display.js, front_end/third_party/codemirror/package/src/display/update_line.js, front_end/third_party/codemirror/package/src/display/update_lines.js, front_end/third_party/codemirror/package/src/edit/CodeMirror.js, front_end/third_party/codemirror/package/src/edit/commands.js, front_end/third_party/codemirror/package/src/edit/drop_events.js, front_end/third_party/codemirror/package/src/edit/fromTextArea.js, front_end/third_party/codemirror/package/src/edit/key_events.js, front_end/third_party/codemirror/package/src/edit/legacy.js, front_end/third_party/codemirror/package/src/edit/main.js, front_end/third_party/codemirror/package/src/edit/methods.js (+13 more). A vendored library that is a faithful copy except for a handful of altered files is a well-worn supply-chain shape — the surrounding real code lends the tree legitimacy while the altered files carry the payload. These files are NOT exempt from any authorship heuristic; diff them against [email protected] before greenflagging.

HIGH Modified vendored dependency: front_end/third_party/web-vitals/package (5 file(s)) vendored-integrity

The directory `front_end/third_party/web-vitals/package` byte-matched 113 of 118 file(s) against [email protected] — a version that passed review and that we hold in storage — which identifies it as a vendored copy of that package. But 5 file(s) inside it differ from that package's bytes at the same path: front_end/third_party/web-vitals/package/dist/modules/attribution/onINP.js, front_end/third_party/web-vitals/package/dist/modules/lib/initMetric.d.ts, front_end/third_party/web-vitals/package/dist/modules/types/inp.d.ts, front_end/third_party/web-vitals/package/src/attribution/onINP.ts, front_end/third_party/web-vitals/package/src/types/inp.ts. A vendored library that is a faithful copy except for a handful of altered files is a well-worn supply-chain shape — the surrounding real code lends the tree legitimacy while the altered files carry the payload. These files are NOT exempt from any authorship heuristic; diff them against [email protected] before greenflagging.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.0.1662289

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.0.1661063

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.0.1660788

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.0.1657855

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.0.1657110

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.0.1656897

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.0.1656291

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.0.1654411

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.0.1652307

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.