phantomjs-prebuilt
Headless WebKit with JS API
4
Versions
Apache-2.0
License
Yes
Install Scripts
Missing
Provenance
Supply chain provenance
Status for the latest visible version.
No SLSA provenance
npm registry signatures
gitHead linked
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
medium
Keywords
phantomjsheadlesswebkit
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| publish-pattern | new-deps-added | AI (publish-pattern): es6-promise is a well-known, benign Promise polyfill with no malicious history; not a meaningful attack vector for this package. | ai | |
| maintainer-change | maintainer-added | AI (maintainer-change): New maintainers dpup and medium are Dan Pupius and Medium org — directly tied to the package's own GitHub repo and author field. Legitimate organizational addition, not a suspicious takeover. | ai | |
| source-diff | source-size-tripled | AI (source-diff): 88x size increase is fully explained by bundling request and its transitive dependencies directly into the tarball. No obfuscation or malicious payload present. | ai | |
| source-diff | large-new-source-files | AI (source-diff): Size increase is due to vendored/bundled runtime dependencies (request and transitive deps), a known pattern for phantomjs-prebuilt. Not injected malicious code. | ai | |
| dependencies | unvetted-dep:request | AI (dependencies): request is a well-known HTTP client used to download prebuilt binaries; appropriate for this package's age and purpose. | ai | |
| install-scripts | install-script:install | AI (install-scripts): phantomjs-prebuilt's install script downloads prebuilt PhantomJS binaries; this is the package's documented and expected install flow. | ai | |
| provenance | no-provenance | AI (provenance): Legacy package predates Sigstore provenance; not a risk signal for established packages. | ai | |
| semgrep | semgrep:dynamic-require | AI (semgrep): Dynamic require loads platform-specific config by path in lib/util.js; standard pattern for this package. | ai | |
| semgrep | semgrep:child-process-import | AI (semgrep): child_process is used in install.js to verify the downloaded PhantomJS binary; standard for prebuilt binary packages. | ai |