electron-rebuild
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| semgrep | semgrep:env-spread | AI (semgrep): Intentional: spreads process.env to isolate clang build environment variables; core functionality of this build tool. | ai | |
| semgrep | semgrep:env-bulk-read | AI (semgrep): Used to save/restore env around clang builds; expected pattern for this native rebuild tool. | ai | |
| semgrep | semgrep:child-process-import | AI (semgrep): Runs uname and node-gyp commands; fundamental to this native module rebuilder's purpose. | ai | |
| semgrep | semgrep:base64-decode | AI (semgrep): Cache serialization/deserialization of binary snapshot data; benign utility use. | ai | |
| semgrep | semgrep:dynamic-require | AI (semgrep): Reads own package.json for version display; stable false positive for this package. | ai |
Versions (showing 1 of 1)
| Version | Deps | Published |
|---|---|---|
| 3.2.9 | 14 / 27 |
v3.2.9
2 findingsSpreading entire process.env into an object — may capture all secrets Source: https://github.com/electron/electron-rebuild/blob/6f94aaace0ea72a342e9249328293644caec5723/lib/src/module-type/node-gyp.js#L83 81 | } 82 | if (this.rebuilder.useElectronClang) { > 83 | env = { ...process.env }; 84 | const { env: clangEnv, args: clangArgs } = await (0, clang_fetcher_1.getClangEnvironmentVars)(this.rebuilder 85 | Object.assign(process.env, clangEnv);
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.