← Home

tree-sitter-typescript

npm Repository Homepage
4
Versions
—
License
Yes
Install Scripts
Missing
Provenance

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.

Maintainers

amaanqahlincmaxbrunsfeldtclemdaviwilqueervioletrewinfreyben3eeeatom-teamdarangipatrickthomson

Keywords

incrementalparsingtree-sittertypescripttsx

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
phantom-deps phantom-dep:nan AI (phantom-deps): nan used via native binding build, not direct import; stable FP. ai
bogus-package bogus-package AI (bogus-package): Legitimate, widely-used grammar package despite thin README/no repo link. ai
npm-metadata url-dep:tree-sitter-javascript AI (npm-metadata): Sibling tree-sitter grammar as devDependency, standard for this monorepo family. ai
install-scripts install-script:install AI (install-scripts): node-gyp-build install script is the standard prebuilt binary loader for native Node.js addons; stable and expected for tree-sitter-typescript across all versions. ai
npm-metadata bundled-binaries AI (npm-metadata): Prebuilt .node binaries for multiple platforms are the documented distribution mechanism for tree-sitter grammar bindings; consistent across all versions. ai
semgrep semgrep:dynamic-require AI (semgrep): Dynamic require is a platform/arch path interpolation to load the correct prebuilt binary — standard native addon pattern, not arbitrary code loading. ai

Versions (showing 4 of 4)

Version Deps Published
0.23.2 3 / 4
0.19.0 1 / 2
0.13.0 1 / 2
0.1.0 1 / 2

v0.19.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.13.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.1.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.