← Home

@sap/hana-client

npm

Official SAP HANA Node.js Driver

7
Versions
SEE LICENSE IN developer-license-3_2.txt
License
Yes
Install Scripts
Missing
Provenance

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures No source commit

Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.

Maintainers

sap_extncrepossap-ospo-admin

Keywords

SAPHANAclientin-memorydatabaseSQLbusinessapplicationintelligententerprisecloudanalyticsexperience

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
maintainer-change maintainer-added AI (maintainer-change): sap-ospo-admin is SAP's OSS admin account; expected for this official SAP package. ai
semgrep semgrep:eval-usage AI (semgrep): eval() in Stream.js is used for dynamic dispatch in stream handling, consistent with a database driver's legitimate parsing logic. Stable pattern across versions of this SAP package. ai
provenance no-provenance AI (provenance): SAP's enterprise npm publishing pipeline does not use Sigstore attestation; publisher identity is well-established with 58 approved packages. ai
install-scripts install-script:install AI (install-scripts): checkbuild.js is the standard install script for this native HANA client driver; it selects the correct prebuilt binary for the platform. Stable across all versions. ai
semgrep semgrep:dynamic-require AI (semgrep): Dynamic require resolves a local path (__dirname/lib/index) for platform-specific binary loading. Not arbitrary code loading; stable pattern for this package. ai
npm-metadata bundled-binaries AI (npm-metadata): Prebuilt .node binaries for multiple platforms are the documented distribution mechanism for the SAP HANA Node.js driver. Expected and stable across all versions. ai
semgrep semgrep:child-process-import AI (semgrep): child_process is used only to run 'ldd --version' to detect musl libc for binary selection. Benign and stable pattern for this package. ai

Versions (showing 7 of 7)

Version Deps Published
2.28.21 1 / 0
2.28.17 1 / 0
2.27.23 1 / 0
2.27.19 1 / 0
2.26.26 1 / 0
2.25.31 1 / 0
2.25.29 1 / 0

v2.28.21

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.28.17

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.27.23

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.27.19

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.26.26

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.25.31

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.25.29

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.