← Home

chrome-devtools-frontend

npm Repository Homepage
100
Versions
—
License
No
Install Scripts
Attested
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation (unverified) npm registry signatures gitHead linked

Maintainers

paulirishmathiasgoogle-wombot

Keywords

devtoolschromechromiumblinkdebugger

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
semgrep semgrep:toplevel-fetch AI (semgrep): Loads local trace fixture via import.meta.url in a docs demo; no remote destination. ai
vendored-integrity tampered-vendored-dep:front_end/third_party/intl-messageformat/package AI (vendored-integrity): DevTools patches its pinned third_party trees; expected divergence, no payload. ai
vendored-integrity tampered-vendored-dep:front_end/third_party/marked/package AI (vendored-integrity): Only differing file is LICENSE.md; license edit in an official Chromium vendored tree, not a payload. ai
install-scripts install-script:preinstall AI (install-scripts): Preinstall is a guard that echoes/exits; no arbitrary execution. Stable across versions. ai
npm-metadata bundled-binaries AI (npm-metadata): wasm_source_map binding is part of official DevTools; stable across versions. ai
semgrep semgrep:child-process-exec AI (semgrep): Local dev script launching Chrome for testing, not a network payload. ai
vendored-integrity tampered-vendored-dep:front_end/third_party/codemirror/package AI (vendored-integrity): Chromium-patched vendored codemirror fork; stable across versions. ai
vendored-integrity tampered-vendored-dep:front_end/third_party/web-vitals/package AI (vendored-integrity): Chromium-patched vendored web-vitals fork; stable across versions. ai
vendored-integrity tampered-vendored-dep:front_end/third_party/puppeteer/package AI (vendored-integrity): Chromium maintains patched forks of third_party deps; expected divergence in DevTools tree. ai
bogus-package bogus-package AI (bogus-package): Chromium release semver + README are expected for this official mirror. ai
install-scripts install-script:install AI (install-scripts): node-gyp rebuild native build; standard for this package. ai
semgrep semgrep:etc-passwd-access AI (semgrep): String appears in a comment explaining a security mitigation, not actual file access. ai
semgrep semgrep:child-process-spawn AI (semgrep): Spawns blink test runner in test script; expected for a devtools frontend package. ai
provenance no-provenance AI (provenance): Established package with 2160 versions; lack of Sigstore provenance is common and not a risk signal here. ai
semgrep semgrep:api-obfuscation-reflect AI (semgrep): Reflect.get() used as a standard Proxy trap in DWARF debugger extension — not obfuscation. ai
semgrep semgrep:eval-usage AI (semgrep): eval() is in legacy test runner code evaluating test expressions — not runtime production code. ai
semgrep semgrep:child-process-import AI (semgrep): child_process used in scripts/npm_test.js to run blink tests — standard build/test tooling. ai
semgrep semgrep:shady-links-raw-ip AI (semgrep): Raw IPs appear only in unit test fixtures (localhost/127.0.0.1), not production network calls. ai
source-diff obfuscated-file:front_end/third_party/lit/lib/async-directive.js AI (source-diff): Minified Lit HTML library (Google LLC, BSD-3-Clause) bundled as a third-party dependency in Chrome DevTools Frontend. Minification is expected for this package's third-party vendored assets. ai
semgrep semgrep:dynamic-require AI (semgrep): Fires in CodeMirror's loadmode.js addon, which legitimately uses dynamic require to load syntax modes on demand. Well-known, documented behavior. ai
semgrep semgrep:shady-links-tlds AI (semgrep): Fires in third-party-web data catalog listing known ad/analytics domains (e.g. marketingplatform.google.com). These are legitimate reference URLs in a data file, not C2 infrastructure. ai
semgrep semgrep:base64-decode AI (semgrep): Fires in Lighthouse report bundle; base64 usage is for legitimate report rendering (SVG/template content), not payload obfuscation. ai
semgrep semgrep:new-function-constructor AI (semgrep): Fires in bundled axe-core and other third-party libs; new Function() is a documented pattern in axe-core's rule engine. Not a security risk in this package. ai

Versions (showing 100 of 2182)

Version Deps Published
1.0.1567721 0 / 61
1.0.1566234 0 / 62
1.0.1565595 0 / 62
1.0.1564932 0 / 62
1.0.1564339 0 / 62
1.0.1563563 0 / 62
1.0.1563377 0 / 62
1.0.1563104 0 / 62
1.0.1562885 0 / 62
1.0.1562614 0 / 62
1.0.1562379 0 / 62
1.0.1562051 0 / 62
1.0.1561528 0 / 62
1.0.1561080 0 / 62
1.0.1559913 0 / 61
1.0.1558690 0 / 61
1.0.1556696 0 / 61
1.0.1555430 0 / 61
1.0.1555174 0 / 61
1.0.1553956 0 / 61
1.0.1550444 0 / 61
1.0.1549484 0 / 61
1.0.1548980 0 / 61
1.0.1548870 0 / 61
1.0.1547571 0 / 61
1.0.1547147 0 / 61
1.0.1545096 0 / 61
1.0.1544076 0 / 61
1.0.1543472 0 / 61
1.0.1543082 0 / 61
1.0.1542501 0 / 61
1.0.1541552 0 / 61
1.0.1541169 0 / 61
1.0.1539972 0 / 60
1.0.1539728 0 / 60
1.0.1538523 0 / 60
1.0.1538310 0 / 60
1.0.1537860 0 / 60
1.0.1537268 0 / 60
1.0.1536371 0 / 60
1.0.1535712 0 / 60
1.0.1534717 0 / 60
1.0.1534251 0 / 60
1.0.1533544 0 / 60
1.0.1532884 0 / 60
1.0.1532228 0 / 60
1.0.1531367 0 / 60
1.0.1530564 0 / 60
1.0.1529904 0 / 60
1.0.1529186 0 / 60
1.0.1528866 0 / 60
1.0.1526630 0 / 60
1.0.1526203 0 / 60
1.0.1525561 0 / 60
1.0.1524741 0 / 60
1.0.1522585 0 / 60
1.0.1522145 0 / 60
1.0.1521880 0 / 60
1.0.1521746 0 / 60
1.0.1521223 0 / 60
1.0.1520535 0 / 60
1.0.1520139 0 / 60
1.0.1519267 0 / 60
1.0.1518653 0 / 60
1.0.1516909 0 / 60
1.0.1515988 0 / 60
1.0.1515796 0 / 60
1.0.1515446 0 / 60
1.0.1514545 0 / 60
1.0.1513662 0 / 60
1.0.1512349 0 / 60
1.0.1512147 0 / 60
1.0.1510848 0 / 60
1.0.1510180 0 / 60
1.0.1506453 0 / 60
1.0.1473514 0 / 61
1.0.1155899 0 / 0
1.0.1153166 0 / 0
1.0.1070764 0 / 0
1.0.1040857 0 / 0
1.0.1040337 0 / 0
1.0.1040170 0 / 0
1.0.1040084 0 / 0
1.0.1039659 0 / 0
1.0.1039140 0 / 0
1.0.1038685 0 / 0
1.0.1038113 0 / 0
1.0.1037221 0 / 0
1.0.1036726 0 / 0
1.0.1036501 0 / 0
1.0.1035963 0 / 0
1.0.1035409 0 / 0
1.0.1034999 0 / 0
1.0.1034881 0 / 0
1.0.1034802 0 / 0
1.0.1034366 0 / 0
1.0.1033742 0 / 0
1.0.1033423 0 / 0
1.0.1032471 0 / 0
1.0.1032322 0 / 0
Showing 100 of 2182 Next page →

v1.0.1155899

2 findings
HIGH toplevel-fetch: front_end/ui/components/docs/performance_panel/basic.ts:117 semgrep

Top-level fetch() call — could indicate telemetry or data exfiltration at module load Source: https://github.com/ChromeDevTools/devtools-frontend/blob/68983677c383ac910de6513e0247fb573464e5e7/front_end/ui/components/docs/performance_panel/basic.ts#L117 115 | if (fileName) { 116 | const file = new URL(`../../../../../test/unittests/fixtures/traces/${fileName}`, import.meta.url); > 117 | const response = await fetch(file); 118 | const asBlob = await response.blob(); 119 | const asFile = new File([asBlob], `${fileName}`, {

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.0.1153166

2 findings
HIGH toplevel-fetch: front_end/ui/components/docs/performance_panel/basic.ts:117 semgrep

Top-level fetch() call — could indicate telemetry or data exfiltration at module load Source: https://github.com/ChromeDevTools/devtools-frontend/blob/bf4f2fcc886593af85cf7c2d5647d14ebccbbe51/front_end/ui/components/docs/performance_panel/basic.ts#L117 115 | if (fileName) { 116 | const file = new URL(`../../../../../test/unittests/fixtures/traces/${fileName}`, import.meta.url); > 117 | const response = await fetch(file); 118 | const asBlob = await response.blob(); 119 | const asFile = new File([asBlob], `${fileName}`, {

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.0.1070764

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.0.1040857

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.0.1040337

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.0.1040170

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.0.1040084

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.0.1039659

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.0.1039140

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.0.1038685

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.0.1038113

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.0.1037221

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.0.1036726

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.0.1036501

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.0.1035963

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.0.1035409

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.0.1034999

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.0.1034881

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.0.1034802

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.0.1034366

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.0.1033742

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.0.1033423

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.0.1032471

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.0.1032322

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.