usb
Library to access USB devices
5
Versions
MIT
License
Yes
Install Scripts
Attested
Provenance
Supply chain provenance
Status for the latest visible version.
SLSA provenance attestation (unverified)
npm registry signatures
gitHead linked
Maintainers
kevinmehalltcrthegecko
Keywords
usbhardware
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| semgrep | semgrep:child-process-import | AI (semgrep): Standard napi-rs musl detection boilerplate; stable for this package. | ai | |
| semgrep | semgrep:child-process-execsync | AI (semgrep): execSync('ldd --version') for musl detection; standard napi-rs pattern. | ai | |
| semgrep | semgrep:dynamic-require | AI (semgrep): Loads native binary via NAPI_RS_NATIVE_LIBRARY_PATH; standard napi-rs pattern. | ai | |
| provenance | publisher-changed | AI (provenance): Transition to GitHub Actions CI/CD publishing with SLSA provenance; legitimate for this package. | ai | |
| install-scripts | install-script:install | AI (install-scripts): node-gyp-build is the standard install mechanism for native addons with prebuildify prebuilts; expected for a USB hardware binding. | ai | |
| phantom-deps | phantom-dep:@types/w3c-web-usb | AI (phantom-deps): TypeScript type definitions package; consumed by the type system, not via direct JS imports. | ai | |
| npm-metadata | bundled-binaries | AI (npm-metadata): Prebuilt .node binaries for multiple platforms are the standard prebuildify pattern for native Node.js addons. | ai | |
| typosquat | typosquat.levenshtein:qs | AI (typosquat): False positive. 'usb' is a descriptive name for a USB library with 368k weekly downloads; not a typosquat of 'qs'. | ai | |
| phantom-deps | phantom-dep:node-addon-api | AI (phantom-deps): node-addon-api is consumed at the C++ native addon build level (binding.gyp), not via JS imports. | ai |
Versions (showing 5 of 5)
| Version | Deps | Published |
|---|---|---|
| 3.0.1 | 1 / 5 | |
| 3.0.0 | 1 / 5 | |
| 2.18.0 | 3 / 12 | |
| 2.17.0 | 3 / 12 | |
| 2.9.0 | 3 / 12 |
v3.0.1
1 finding
INFO
Has SLSA provenance attestation
provenance
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.