← Home

zxing-wasm

ZXing-C++ WebAssembly as an ES/CJS module with types

9
Versions
MIT
License
No
Install Scripts
Attested
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation (unverified) npm registry signatures No source commit

Maintainers

sec-ant

Keywords

qrcodebarcodewasmzxingzxing-cppesmodulewebassembly

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
npm-metadata bundled-binaries AI (npm-metadata): WASM binaries are the package's core deliverable, built via documented cmake/emscripten flow. ai
source-diff obfuscated-file:dist/miniprogram/index.js AI (source-diff): Bundled dist output for miniprogram target; barcode format tables, no malicious patterns. ai
source-diff obfuscated-file:dist/cjs/share.js AI (source-diff): Standard CJS bundle output; no suspicious code in sample. ai
provenance publisher-changed AI (provenance): Moved from manual publish (sec-ant) to GitHub Actions CI/CD; same repo owner. ai
provenance missing-githead AI (provenance): GitHub Actions publish flow doesn't set gitHead; SLSA provenance compensates. ai
dependencies unvetted-dep:@types/emscripten AI (dependencies): @types/emscripten is the standard TypeScript types package for Emscripten; expected and benign for a WASM project compiled with Emscripten. ai
phantom-deps phantom-dep:@types/emscripten AI (phantom-deps): @types/emscripten augments global types rather than being directly imported; this pattern is standard for Emscripten WASM modules. ai

Versions (showing 9 of 9)

Version Deps Published
3.1.1 2 / 21
3.1.0 2 / 21
3.0.3 2 / 20
3.0.2 2 / 20
3.0.1 2 / 24
3.0.0 2 / 24
2.2.4 2 / 24
2.2.3 2 / 24
1.1.3 1 / 13

v3.1.1

2 findings
HIGH Bundled binary files (3) npm-metadata

Package contains compiled binaries that could be backdoors: • dist/full/zxing_full.wasm • dist/reader/zxing_reader.wasm • dist/writer/zxing_writer.wasm

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.