tree-sitter — Greenflagged

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.

Maintainers

ahlincmaxbrunsfeldamaanqtclemrewinfreyrobrixjoshverapatrickthomsonverhovsky

Keywords

incrementalparsingtree-sitter

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
phantom-deps	phantom-dep:prebuild-install	AI (phantom-deps): Used only in install script, standard prebuilt-binary fetch pattern.	ai	2026/07/19
phantom-deps	phantom-dep:nan	AI (phantom-deps): nan is a native-binding build dep, not directly imported by design.	ai	2026/07/19
npm-metadata	url-dep:tree-sitter-javascript	AI (npm-metadata): Dev-only test grammar dep pointing to sibling official repo, no runtime risk.	ai	2026/07/19
npm-metadata	suspicious-initial-version	AI (npm-metadata): Legit historical first version of a long-trusted native binding package.	ai	2026/07/19
publish-pattern	dormant-publish	AI (publish-pattern): Mature, high-trust package with long stable release cadence; dormancy is normal, not takeover.	ai	2026/07/07
dependencies	unvetted-dep:node-gyp-build	AI (dependencies): node-gyp-build is the standard native addon binary loader; its use here is expected and appropriate.	ai	2026/04/25
semgrep	semgrep:dynamic-require	AI (semgrep): Dynamic require constructs a platform/arch path to load the native .node addon — standard pattern for native bindings, not a supply-chain risk.	ai	2026/04/25
install-scripts	install-script:install	AI (install-scripts): node-gyp-build is the canonical install script for native Node.js addons shipping prebuilts; stable and expected for tree-sitter across all versions.	ai	2026/04/25
phantom-deps	phantom-dep:node-addon-api	AI (phantom-deps): node-addon-api is referenced in binding.gyp for native compilation, not JS imports — standard N-API addon pattern.	ai	2026/04/25
semgrep	semgrep:eval-usage	AI (semgrep): eval() is used to create dynamically-named SyntaxNode subclasses from grammar type names — a legitimate pattern, not external input. Not a supply-chain risk.	ai	2026/04/25
npm-metadata	bundled-binaries	AI (npm-metadata): Prebuilt .node binaries for major platforms are the documented output of prebuildify; expected for this native addon package.	ai	2026/04/25