@datadog/native-iast-taint-tracking

Datadog IAST tant tracking support for NodeJS

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures No source commit

Maintainers

datadog

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
install-scripts	install-script:install	AI (install-scripts): Install script is literally `exit 0` — a no-op placeholder; stable for this native addon package.	ai	2026/05/04
npm-metadata	bundled-binaries	AI (npm-metadata): Prebuilt .node binaries are the expected distribution mechanism for this native addon; SLSA provenance confirms CI/CD build integrity.	ai	2026/05/04
semgrep	semgrep:child-process-import	AI (semgrep): child_process used in libc.js to detect Linux libc variant for prebuild selection — standard native addon pattern.	ai	2026/05/04

Versions (showing 2 of 2)

Version	Deps	Published
4.1.0	1 / 9	2025-11-06
4.0.0	1 / 9	2025-05-12

v4.1.0

3 findings

HIGH Package has 'install' script install-scripts

Script: exit 0

HIGH Bundled binary files (56) npm-metadata

Package contains compiled binaries that could be backdoors: • prebuilds/darwin-arm64/node-108.node • prebuilds/darwin-x64/node-108.node • prebuilds/linuxglibc-arm64/node-108.node • prebuilds/linuxglibc-x64/node-108.node • prebuilds/linuxmusl-arm64/node-108.node • prebuilds/linuxmusl-x64/node-108.node • prebuilds/win32-x64/node-108.node • prebuilds/darwin-arm64/node-111.node • prebuilds/darwin-x64/node-111.node • prebuilds/linuxglibc-arm64/node-111.node ... and 46 more

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v4.0.0

3 findings

HIGH Package has 'install' script install-scripts

Script: exit 0

HIGH Bundled binary files (49) npm-metadata

Package contains compiled binaries that could be backdoors: • prebuilds/darwin-arm64/node-108.node • prebuilds/darwin-x64/node-108.node • prebuilds/linuxglibc-arm64/node-108.node • prebuilds/linuxglibc-x64/node-108.node • prebuilds/linuxmusl-arm64/node-108.node • prebuilds/linuxmusl-x64/node-108.node • prebuilds/win32-x64/node-108.node • prebuilds/darwin-arm64/node-111.node • prebuilds/darwin-x64/node-111.node • prebuilds/linuxglibc-arm64/node-111.node ... and 39 more

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.