zxing-wasm
ZXing-C++ WebAssembly as an ES/CJS module with types
9
Versions
MIT
License
No
Install Scripts
Attested
Provenance
Supply chain provenance
Status for the latest visible version.
SLSA provenance attestation (unverified)
npm registry signatures
No source commit
Maintainers
sec-ant
Keywords
qrcodebarcodewasmzxingzxing-cppesmodulewebassembly
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| npm-metadata | bundled-binaries | AI (npm-metadata): WASM binaries are the package's core deliverable, built via documented cmake/emscripten flow. | ai | |
| source-diff | obfuscated-file:dist/miniprogram/index.js | AI (source-diff): Bundled dist output for miniprogram target; barcode format tables, no malicious patterns. | ai | |
| source-diff | obfuscated-file:dist/cjs/share.js | AI (source-diff): Standard CJS bundle output; no suspicious code in sample. | ai | |
| provenance | publisher-changed | AI (provenance): Moved from manual publish (sec-ant) to GitHub Actions CI/CD; same repo owner. | ai | |
| provenance | missing-githead | AI (provenance): GitHub Actions publish flow doesn't set gitHead; SLSA provenance compensates. | ai | |
| dependencies | unvetted-dep:@types/emscripten | AI (dependencies): @types/emscripten is the standard TypeScript types package for Emscripten; expected and benign for a WASM project compiled with Emscripten. | ai | |
| phantom-deps | phantom-dep:@types/emscripten | AI (phantom-deps): @types/emscripten augments global types rather than being directly imported; this pattern is standard for Emscripten WASM modules. | ai |
Versions (showing 9 of 9)
| Version | Deps | Published |
|---|---|---|
| 3.1.1 | 2 / 21 | |
| 3.1.0 | 2 / 21 | |
| 3.0.3 | 2 / 20 | |
| 3.0.2 | 2 / 20 | |
| 3.0.1 | 2 / 24 | |
| 3.0.0 | 2 / 24 | |
| 2.2.4 | 2 / 24 | |
| 2.2.3 | 2 / 24 | |
| 1.1.3 | 1 / 13 |
v3.1.1
2 findings
HIGH
Bundled binary files (3)
npm-metadata
Package contains compiled binaries that could be backdoors: • dist/full/zxing_full.wasm • dist/reader/zxing_reader.wasm • dist/writer/zxing_writer.wasm
INFO
Has SLSA provenance attestation
provenance
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.