classic-level
An abstract-level database backed by LevelDB
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| dependencies | unvetted-dep:node-gyp-build | AI (dependencies): node-gyp-build is a well-known, widely-used utility for native addon prebuilds; no security concern for this package. | ai | |
| install-scripts | install-script:install | AI (install-scripts): classic-level is a native LevelDB addon; node-gyp-build install script is the standard mechanism for selecting prebuilt binaries. Stable for this package. | ai | |
| npm-metadata | bundled-binaries | AI (npm-metadata): Prebuilt .node binaries are the documented distribution mechanism for this native addon, built via prebuildify for multiple platforms. Stable for this package. | ai | |
| phantom-deps | phantom-dep:napi-macros | AI (phantom-deps): napi-macros is a C++ build-time macro dependency, not a JS import. package.json explicitly excludes it from dependency-check with -i flag. Stable false positive for this package. | ai |
Versions (showing 7 of 7)
| Version | Deps | Published |
|---|---|---|
| 3.0.0 | 4 / 20 | |
| 2.0.0 | 4 / 21 | |
| 1.4.1 | 5 / 23 | |
| 1.3.0 | 5 / 23 | |
| 1.2.0 | 5 / 24 | |
| 1.1.0 | 5 / 24 | |
| 1.0.0 | 5 / 24 |
v3.0.0
3 findingsScript: node-gyp-build
Package contains compiled binaries that could be backdoors: • prebuilds/linux-arm/classic-level.armv6.node • prebuilds/android-arm/classic-level.armv7.node • prebuilds/linux-arm/classic-level.armv7.node • prebuilds/android-arm64/classic-level.armv8.node • prebuilds/linux-arm64/classic-level.armv8.node • prebuilds/linux-x64/classic-level.musl.node • prebuilds/linux-x64/classic-level.node • prebuilds/win32-ia32/classic-level.node • prebuilds/win32-x64/classic-level.node
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.0.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.