fsevents
Native Access to MacOS FSEvents
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | source-size-dropped | AI (source-diff): Size drop reflects removal of bundled prebuilt binaries in favor of on-demand build via install script; consistent with the package's known evolution. | ai | |
| semgrep | semgrep:child-process-import | AI (semgrep): child_process usage in install.js is limited to conditional native addon rebuild on Darwin — legitimate and expected for this native binding package. | ai | |
| publish-pattern | new-deps-added | AI (publish-pattern): The added 'bindings' dependency is a standard, well-known helper for native Node.js addons. Its use is appropriate and expected for fsevents. | ai | |
| phantom-deps | phantom-dep:nan | AI (phantom-deps): nan is a C++ native addon abstraction used in binding source files, not JS imports. This is expected for native Node.js addons and stable for this package. | ai | |
| phantom-deps | phantom-dep:node-pre-gyp | AI (phantom-deps): node-pre-gyp is a bundled dependency used as a build/install tool for native bindings, not directly imported in JS. Expected pattern for this package. | ai | |
| maintainer-change | maintainer-removed | AI (maintainer-change): Maintainer list narrowed during v1→v2 rewrite; original author pipobscure remains publisher. Removed maintainers still listed as contributors. | ai | |
| npm-metadata | bundled-binaries | AI (npm-metadata): fsevents v2 ships a prebuilt .node binary to avoid requiring node-gyp at install time; this is the documented architecture for the package. | ai | |
| provenance | no-provenance | AI (provenance): No provenance is common (~12% adoption); fsevents is a well-established package with long publisher history. | ai | |
| install-scripts | install-script:install | AI (install-scripts): node-gyp rebuild is the standard install flow for this native macOS FSEvents binding; stable for all versions of fsevents. | ai | |
| provenance | publisher-changed | AI (provenance): pipobscure (Philipp Dunkel) is the original author of fsevents, listed as first contributor; legitimate maintainer. | ai |
Versions (showing 19 of 19)
| Version | Deps | Published |
|---|---|---|
| 2.3.1 | 0 / 1 | |
| 2.2.0 | 0 / 1 | |
| 2.1.3 | 0 / 1 | |
| 1.2.13 | 2 / 0 | |
| 1.2.12 | 3 / 0 | |
| 0.3.8 | 1 / 1 | |
| 0.3.7 | 1 / 1 | |
| 0.3.6 | 1 / 1 | |
| 0.3.5 | 1 / 1 | |
| 0.3.4 | 1 / 1 | |
| 0.3.3 | 1 / 1 | |
| 0.3.2 | 1 / 1 | |
| 0.3.1 | 1 / 1 | |
| 0.3.0 | 1 / 1 | |
| 0.1.6 | 0 / 0 | |
| 0.1.5 | 0 / 0 | |
| 0.1.4 | 0 / 0 | |
| 0.1.3 | 0 / 0 | |
| 0.1.1 | 0 / 0 |
v2.3.1
3 findingsScript: node-gyp rebuild
This version was published by a different npm account than previous versions on 2021-01-05. This could indicate a legitimate maintainer transition or an account compromise.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.2.0
2 findingsPackage contains compiled binaries that could be backdoors: • fsevents.node
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.1.3
2 findingsPackage contains compiled binaries that could be backdoors: • fsevents.node
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.2.13
2 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2020-05-05. This could indicate a legitimate maintainer transition or an account compromise.
v1.2.12
2 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2020-03-19. This could indicate a legitimate maintainer transition or an account compromise.