@serialport/bindings-cpp
SerialPort Hardware bindings for node serialport written in c++
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| dependencies | unvetted-dep:node-gyp-build | AI (dependencies): node-gyp-build is a well-known, widely-used utility for native Node.js addons; appropriate dependency for this package. | ai | |
| install-scripts | install-script:install | AI (install-scripts): node-gyp-build is the standard install mechanism for native Node.js addons; stable and expected for this C++ bindings package across all versions. | ai | |
| npm-metadata | bundled-binaries | AI (npm-metadata): Prebuilt .node binaries for multiple platforms are the expected output of prebuildify for a cross-platform native addon; consistent with the package's documented build process. | ai | |
| phantom-deps | phantom-dep:node-addon-api | AI (phantom-deps): node-addon-api provides C++ headers used during native compilation (referenced in binding.gyp), not imported at JS runtime. False positive for native addon packages. | ai |
v13.0.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v13.0.0
3 findingsScript: node-gyp-build
Package contains compiled binaries that could be backdoors: • prebuilds/linux-arm/@serialport+bindings-cpp.armv6.glibc.node • prebuilds/linux-arm/@serialport+bindings-cpp.armv7.glibc.node • prebuilds/linux-arm/@serialport+bindings-cpp.armv7.musl.node • prebuilds/android-arm/@serialport+bindings-cpp.armv7.node • prebuilds/linux-arm64/@serialport+bindings-cpp.armv8.glibc.node • prebuilds/linux-arm64/@serialport+bindings-cpp.armv8.musl.node • prebuilds/android-arm64/@serialport+bindings-cpp.armv8.node • prebuilds/win32-arm64/@serialport+bindings-cpp.armv8.node • prebuilds/linux-x64/@serialport+bindings-cpp.glibc.node • prebuilds/linux-x64/@serialport+bindings-cpp.musl.node ... and 2 more
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.