jsforce
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | encoded-string-file:dist/jsforce-core.js | AI (source-diff): Webpack bundle contains standard DH/EC crypto constants; stable false positive for this package. | ai | |
| source-diff | encoded-string-file:dist/jsforce-core.min.js | AI (source-diff): Minified webpack bundle of the same crypto constants. | ai | |
| source-diff | encoded-string-file:dist/jsforce.js | AI (source-diff): Webpack bundle contains standard DH/EC crypto constants; stable false positive. | ai | |
| source-diff | encoded-string-file:dist/jsforce.min.js | AI (source-diff): Minified webpack bundle of the same crypto constants. | ai | |
| semgrep | semgrep:child-process-import | AI (semgrep): child_process used in SFDX registry integration to invoke the sfdx CLI — expected and documented behavior. | ai | |
| phantom-deps | phantom-dep:@babel/runtime | AI (phantom-deps): @babel/runtime is a declared runtime dep used by Babel-transpiled browser output; loaded by convention, not direct import. | ai | |
| semgrep | semgrep:base64-decode | AI (semgrep): Base64 decoding is used for Salesforce Metadata API zip file handling — core library functionality. | ai |
v3.10.15
5 findingsModified file contains 7 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 7 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 7 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 7 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.10.14
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.