duckdb
4
Versions
—
License
Yes
Install Scripts
Attested
Provenance
Supply chain provenance
Status for the latest visible version.
SLSA provenance attestation (unverified)
npm registry signatures
gitHead linked
Maintainers
duckdb_adminmraasveldt
Keywords
databasesqlduckdb
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| phantom-deps | phantom-dep:node-gyp | AI (phantom-deps): node-gyp is a standard implicit build dependency for native addons; not directly imported but required by the build toolchain. | ai | |
| phantom-deps | phantom-dep:node-addon-api | AI (phantom-deps): node-addon-api is a standard native addon build dependency referenced in binding config files; not directly imported in JS. | ai | |
| install-scripts | install-script:install | AI (install-scripts): node-pre-gyp install --fallback-to-build is the standard install pattern for native Node.js addons; stable and expected for duckdb's native binding. | ai | |
| semgrep | semgrep:dynamic-require | AI (semgrep): Dynamic require loads the compiled native .node binary via node-pre-gyp's binary.find(); standard pattern for native addons, not arbitrary code loading. | ai |