event-loop-delay MIT 6 versions

event-loop-delay

npm Repository Homepage

A minimal overhead event loop delay sampler.

6

Versions

MIT

License

No

Install Scripts

Missing

Provenance

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.

Maintainers

mafintosh

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
npm-metadata	suspicious-initial-version	AI (npm-metadata): 0.0.0 versioning is a legitimate choice by mafintosh for this early-release native binding; not indicative of malicious intent given the author's long track record.	ai	2026/04/24
npm-metadata	bundled-binaries	AI (npm-metadata): Prebuilt .node binaries are expected for this native NAPI addon; generated via prebuildify as documented in package.json scripts and devDependencies.	ai	2026/04/24
dependencies	unvetted-dep:node-gyp-build	AI (dependencies): node-gyp-build is the canonical runtime loader for prebuildify native addons; its use here is expected and appropriate.	ai	2026/04/24
phantom-deps	phantom-dep:napi-macros	AI (phantom-deps): napi-macros is used at native build time in C headers/macros, not directly imported in JS; this phantom-dep pattern is normal for NAPI macro packages.	ai	2026/04/24

Versions (showing 6 of 6)

Version	Deps	Published
1.1.2	1 / 0	2025-06-11
1.1.1	1 / 0	2025-06-11
1.1.0	1 / 0	2024-11-18
1.0.1	2 / 1	2019-11-18
1.0.0	2 / 1	2019-01-03
0.0.0	2 / 1	2019-01-03

v1.1.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.1.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.1.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.0.1

2 findings

HIGH Bundled binary files (4) npm-metadata

Package contains compiled binaries that could be backdoors: • native/prebuilds/darwin-x64/electron.napi.node • native/prebuilds/linux-x64/electron.napi.node • native/prebuilds/darwin-x64/node.napi.node • native/prebuilds/linux-x64/node.napi.node

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.0.0

2 findings

HIGH Bundled binary files (4) npm-metadata

Package contains compiled binaries that could be backdoors: • native/prebuilds/darwin-x64/electron-napi.node • native/prebuilds/darwin-x64/node-napi.node • native/prebuilds/linux-x64/electron-napi.node • native/prebuilds/linux-x64/node-napi.node

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.