bplist-parser

Binary plist parser.

Supply chain provenance

Status for the latest visible version.

Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.

Maintainers

Keywords

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
dependencies	unvetted-dep:big-integer	AI (dependencies): big-integer is a well-known arbitrary-precision integer library; its use in a bplist parser for 64-bit integer handling is legitimate and expected.	ai	2026/04/21
publish-pattern	new-deps-added	AI (publish-pattern): big-integer addition is justified by the need to handle 64-bit integers in bplist files; no malicious pattern.	ai	2026/04/21

Version	Deps	Published
0.3.2	1 / 2	2022-05-03
0.3.1	1 / 2	2021-11-09
0.3.0	1 / 2	2021-03-08
0.2.0	1 / 1	2019-07-12
0.1.1	1 / 1	2015-11-19
0.1.0	0 / 1	2015-05-18
0.0.6	0 / 1	2014-10-23
0.0.5	0 / 1	2014-02-28
0.0.4	0 / 1	2012-09-08
0.0.3	0 / 1	2012-08-23
0.0.2	0 / 1	2012-08-14
0.0.1	0 / 1	2012-08-06