← Home

better-sqlite3

npm Repository Homepage

The fastest and simplest library for SQLite in Node.js.

7
Versions
MIT
License
Yes
Install Scripts
Verified
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures gitHead linked

Maintainers

joshuawise

Keywords

sqlsqlitesqlite3transactionsuser-defined functionsaggregate functionswindow functionsdatabase

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
publish-pattern dormant-publish AI (publish-pattern): better-sqlite3 is a high-trust, high-traffic native addon with 60 approved dependents. Publisher identity matches documented author; dormancy is consistent with major version development cycles. ai
provenance publisher-changed AI (provenance): Transition from personal publish to GitHub Actions CI/CD with SLSA provenance; legitimate pipeline modernization for this well-established package. ai
provenance no-provenance AI (provenance): better-sqlite3 is a well-established package with 5.9M weekly downloads and 152 versions; lack of Sigstore provenance is not a meaningful risk signal for this package. ai
install-scripts install-script:install AI (install-scripts): better-sqlite3 is a native Node.js addon; prebuild-install || node-gyp rebuild is its standard documented install flow for fetching/building the SQLite binary binding. ai
phantom-deps phantom-dep:prebuild-install AI (phantom-deps): prebuild-install is declared as a runtime dependency and used directly in the install script as a binary; this is a known implicit binary dependency pattern, not a real phantom dep. ai

Versions (showing 7 of 7)

Version Deps Published
12.10.0 2 / 8
12.9.0 2 / 8
12.6.2 2 / 8
12.4.6 2 / 8
12.4.5 2 / 8
12.0.0 2 / 8
11.8.1 2 / 8

v12.10.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v12.6.2

2 findings
HIGH Publisher changed: joshuawise → GitHub Actions (on 2026-01-17) provenance

This version was published by a different npm account than previous versions on 2026-01-17. This could indicate a legitimate maintainer transition or an account compromise.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v12.4.6

2 findings
HIGH Publisher changed: joshuawise → GitHub Actions (on 2025-11-22) provenance

This version was published by a different npm account than previous versions on 2025-11-22. This could indicate a legitimate maintainer transition or an account compromise.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v12.4.5

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v12.0.0

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v11.8.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.