fibers
5
Versions
—
License
Yes
Install Scripts
Missing
Provenance
Supply chain provenance
Status for the latest visible version.
No SLSA provenance
npm registry signatures
No source commit
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
laverdetmdgfilipenevolarenanccastro
Keywords
fiberfiberscoroutinethreadasyncparallelworkerfuturepromise
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| provenance | no-provenance | AI (provenance): fibers is a 15-year-old established native addon; lack of Sigstore provenance is expected for packages of this age and does not indicate risk. | ai | |
| dependencies | unvetted-dep:detect-libc | AI (dependencies): detect-libc is used to select the correct pre-built binary (glibc vs musl); legitimate and expected dependency for this native addon. | ai | |
| semgrep | semgrep:child-process-import | AI (semgrep): child_process is used solely in build.js to invoke node-gyp for native compilation. No malicious use pattern present. | ai | |
| install-scripts | install-script:install | AI (install-scripts): fibers is a native addon; install script invokes node-gyp via build.js to compile C++ bindings. This is the documented, expected build flow for this package. | ai | |
| semgrep | semgrep:dynamic-require | AI (semgrep): Dynamic require loads the platform-specific prebuilt .node binary at runtime — standard pattern for cross-platform native addons. | ai | |
| semgrep | semgrep:child-process-spawn | AI (semgrep): spawn is used to run node-gyp rebuild in build.js — standard native addon build pattern. | ai | |
| npm-metadata | bundled-binaries | AI (npm-metadata): Pre-built .node binaries for multiple platforms are standard distribution for native addons, allowing users to skip compilation. Expected for fibers. | ai |