cross-spawn
Cross platform child_process#spawn and child_process#spawnSync
3
Versions
MIT
License
No
Install Scripts
Missing
Provenance
Supply chain provenance
Status for the latest visible version.
No SLSA provenance
npm registry signatures
gitHead linked
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
satazor
Keywords
spawnspawnSyncwindowscross-platformpath-extshebangcmdexecute
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| dependencies | unvetted-dep:nice-try | AI (dependencies): nice-try is a well-known, minimal utility dependency used legitimately by cross-spawn; stable false positive. | ai | |
| semgrep | semgrep:child-process-import | AI (semgrep): child_process import is core to cross-spawn's documented purpose of cross-platform process spawning. | ai | |
| semgrep | semgrep:child-process-spawn | AI (semgrep): spawn() calls are the primary functionality of this package; expected and legitimate. | ai |