weak-napi
Make weak references to JavaScript Objects.
4
Versions
MIT
License
Yes
Install Scripts
Missing
Provenance
Supply chain provenance
Status for the latest visible version.
No SLSA provenance
npm registry signatures
gitHead linked
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
addaleax
Keywords
weakreferencejsjavascriptobjectfunctioncallbacknapi
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| publish-pattern | new-deps-added | AI (publish-pattern): setimmediate-napi is a contextually appropriate NAPI dependency for this native addon package, added by a highly trusted publisher with no rejection history. | ai | |
| npm-metadata | url-dep:node-addon-api | AI (npm-metadata): Points to a specific commit hash in the official nodejs/node-addon-api repo — pinned commit is more secure than semver; stable pattern for this package. | ai | |
| dependencies | unvetted-dep:node-gyp-build | AI (dependencies): node-gyp-build is a well-known, widely-used tool for native addon prebuilt binary selection; not a risk for this package. | ai | |
| install-scripts | install-script:install | AI (install-scripts): node-gyp-build is the standard install script for N-API native addons shipping prebuilts; stable and expected for this package. | ai | |
| phantom-deps | phantom-dep:setimmediate-napi | AI (phantom-deps): setimmediate-napi is a native dependency used at the C++ level, not directly imported in JS; expected pattern for this addon. | ai | |
| npm-metadata | bundled-binaries | AI (npm-metadata): Prebuilt .node binaries are the intended distribution mechanism for this N-API addon, built via prebuildify by a highly trusted publisher. | ai | |
| phantom-deps | phantom-dep:node-addon-api | AI (phantom-deps): node-addon-api is a build-time/compile-time dependency for N-API addons; referenced in binding.gyp, not directly imported in JS. | ai |