← Home

@sailshq/nedb

npm Repository Homepage

File-based embedded data store for node.js

4
Versions
SEE LICENSE IN LICENSE
License
No
Install Scripts
Missing
Provenance

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.

Maintainers

mikermcneilrachaelshawirlsgress454eashawdominuskelvin

Keywords

databasedatastoreembedded

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
typosquat typosquat.levenshtein:next AI (typosquat): @sailshq/nedb is a legitimate scoped fork of the nedb embedded database by the Sails.js team, not a typosquat of Next.js. The edit-distance match is a false positive. ai
semgrep semgrep:child-process-import AI (semgrep): child_process usage is confined to browser-version/build.js, a developer build script not invoked at install or runtime. Stable false positive for this package. ai
semgrep semgrep:child-process-exec AI (semgrep): exec() call in browser-version/build.js runs 'npm install' for build tooling only; not reachable at install or runtime. Stable false positive for this package. ai
semgrep semgrep:new-function-constructor AI (semgrep): new Function() is in the bundled browser output (nedb.js) inside underscore's _.template() implementation — standard template engine behavior, not a malicious payload. ai

Versions (showing 4 of 4)

Version Deps Published
1.8.4 5 / 6
1.8.3 5 / 6
1.8.2 5 / 6
1.8.1 5 / 6

v1.8.4

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.8.3

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.8.2

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.8.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.