usearch — Greenflagged

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures gitHead linked

ashvardanian

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
install-scripts	install-script:install	AI (install-scripts): node-gyp-build is the standard prebuilt binary loader for native addons; stable pattern for this package.	ai	2026/05/05
npm-metadata	bundled-binaries	AI (npm-metadata): Prebuilt .node binaries are expected for this native addon; published via CI with SLSA provenance.	ai	2026/05/05
semgrep	semgrep:dynamic-require	AI (semgrep): Explicitly a ncc bundler workaround (guarded by process.uptime() < 0); not reachable at runtime.	ai	2026/05/05
semgrep	semgrep:shady-links-raw-ip	AI (semgrep): Raw IP is 127.0.0.1 (localhost) in a benchmark tool; not a network exfiltration risk.	ai	2026/05/05
semgrep	semgrep:child-process-import	AI (semgrep): child_process used in benchmark/probe utility scripts, not in the main library code.	ai	2026/05/05
phantom-deps	phantom-dep:node-addon-api	AI (phantom-deps): node-addon-api is a build-time dependency referenced in binding.gyp, not imported in JS source.	ai	2026/05/05

3 findings

HIGH Package has 'install' script install-scripts

Script: node-gyp-build

HIGH Bundled binary files (2) npm-metadata

Package contains compiled binaries that could be backdoors: • prebuilds/linux-arm64/usearch.node • prebuilds/linux-x64/usearch.node

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.