electron
Build cross platform desktop apps with JavaScript, HTML, and CSS
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| phantom-deps | phantom-dep:@types/node | AI (phantom-deps): @types/node is a TypeScript type declaration package legitimately listed as a dependency for type support; not a security concern. | ai | |
| install-scripts | install-script:postinstall | AI (install-scripts): Electron's postinstall runs node install.js to download the prebuilt Electron binary via @electron/get — this is the documented, stable install flow for every Electron release. | ai | |
| semgrep | semgrep:child-process-import | AI (semgrep): child_process is used in cli.js solely to spawn the Electron binary with user-supplied args — the core purpose of the CLI wrapper. | ai | |
| semgrep | semgrep:child-process-spawn | AI (semgrep): proc.spawn in cli.js launches the downloaded Electron binary; this is the intended behavior of the electron CLI entry point. | ai |
Versions (showing 51 of 765)
| Version | Deps | Published |
|---|---|---|
| 42.0.1 | 3 / 0 | |
| 42.0.0 | 3 / 0 | |
| 41.5.2 | 3 / 0 | |
| 41.5.1 | 3 / 0 | |
| 41.5.0 | 3 / 0 | |
| 41.4.0 | 3 / 0 | |
| 41.3.0 | 3 / 0 | |
| 41.2.2 | 3 / 0 | |
| 41.2.0 | 3 / 0 | |
| 40.10.0 | 3 / 0 | |
| 40.9.3 | 3 / 0 | |
| 40.9.2 | 3 / 0 | |
| 39.8.10 | 3 / 0 | |
| 39.8.9 | 3 / 0 | |
| 39.8.7 | 3 / 0 | |
| 39.8.6 | 3 / 0 | |
| 30.0.1 | 3 / 0 | |
| 30.0.0 | 3 / 0 | |
| 29.3.1 | 3 / 0 | |
| 29.3.0 | 3 / 0 | |
| 29.2.0 | 3 / 0 | |
| 29.1.6 | 3 / 0 | |
| 29.1.5 | 3 / 0 | |
| 29.1.4 | 3 / 0 | |
| 29.1.3 | 3 / 0 | |
| 29.1.2 | 3 / 0 | |
| 29.1.1 | 3 / 0 | |
| 29.1.0 | 3 / 0 | |
| 29.0.1 | 3 / 0 | |
| 29.0.0 | 3 / 0 | |
| 28.3.1 | 3 / 0 | |
| 28.3.0 | 3 / 0 | |
| 28.2.10 | 3 / 0 | |
| 28.2.9 | 3 / 0 | |
| 28.2.8 | 3 / 0 | |
| 28.2.7 | 3 / 0 | |
| 28.2.6 | 3 / 0 | |
| 28.2.5 | 3 / 0 | |
| 28.2.4 | 3 / 0 | |
| 28.2.3 | 3 / 0 | |
| 28.2.2 | 3 / 0 | |
| 28.2.1 | 3 / 0 | |
| 28.2.0 | 3 / 0 | |
| 28.1.4 | 3 / 0 | |
| 28.1.3 | 3 / 0 | |
| 28.1.2 | 3 / 0 | |
| 28.1.1 | 3 / 0 | |
| 28.1.0 | 3 / 0 | |
| 28.0.0 | 3 / 0 | |
| 27.3.11 | 3 / 0 | |
| 27.3.10 | 3 / 0 |
v42.0.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v42.0.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v41.5.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v41.5.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v41.5.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v41.4.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v41.3.0
2 findingsScript: node install.js
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v41.2.2
2 findingsScript: node install.js
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v41.2.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v40.10.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v40.9.3
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v40.9.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v39.8.10
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v39.8.9
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v39.8.7
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v39.8.6
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.