devcert
Generate trusted local SSL/TLS certificates for local SSL development
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | obfuscated-file:dist/certificate-authority.js | AI (source-diff): Standard tsc TypeScript compilation output, not obfuscated. Readable code with clear variable names and comments. | ai | |
| source-diff | obfuscated-file:dist/certificates.js | AI (source-diff): Standard tsc TypeScript compilation output, not obfuscated. Readable code with clear variable names and comments. | ai | |
| source-diff | obfuscated-file:dist/platforms/darwin.js | AI (source-diff): Standard tsc TypeScript compilation output, not obfuscated. Readable platform-specific certificate management code. | ai | |
| source-diff | obfuscated-file:dist/platforms/linux.js | AI (source-diff): Standard tsc TypeScript compilation output, not obfuscated. Readable platform-specific certificate management code. | ai | |
| source-diff | obfuscated-file:dist/platforms/shared.js | AI (source-diff): Standard tsc TypeScript compilation output, not obfuscated. Readable NSS certificate database management code. | ai | |
| source-diff | obfuscated-file:dist/user-interface.js | AI (source-diff): Standard tsc TypeScript compilation output, not obfuscated. Readable UI prompt code. | ai | |
| source-diff | obfuscated-file:dist/platforms/win32.js | AI (source-diff): Standard tsc TypeScript compilation output, not obfuscated. Readable Windows certificate management code. | ai | |
| phantom-deps | phantom-dep:@types/rimraf | AI (phantom-deps): @types/* phantom dep — TypeScript type declaration, benign packaging quirk for this package. | ai | |
| semgrep | semgrep:dynamic-require | AI (semgrep): Dynamic require on process.platform is devcert's intentional cross-platform dispatch pattern (linux/darwin/win32 platform modules). Stable and benign for this package. | ai | |
| phantom-deps | phantom-dep:@types/configstore | AI (phantom-deps): @types/* phantom dep — TypeScript type declaration, benign packaging quirk for this package. | ai | |
| phantom-deps | phantom-dep:@types/get-port | AI (phantom-deps): @types/* phantom dep — TypeScript type declaration, benign packaging quirk for this package. | ai | |
| phantom-deps | phantom-dep:@types/tmp | AI (phantom-deps): All @types/* phantom deps are TypeScript type declarations listed as runtime deps in an older TS project convention — not actually imported at runtime, no security risk. | ai | |
| phantom-deps | phantom-dep:@types/glob | AI (phantom-deps): @types/* phantom dep — TypeScript type declaration, benign packaging quirk for this package. | ai | |
| phantom-deps | phantom-dep:@types/node | AI (phantom-deps): @types/* phantom dep — TypeScript type declaration, benign packaging quirk for this package. | ai | |
| phantom-deps | phantom-dep:@types/debug | AI (phantom-deps): @types/* phantom dep — TypeScript type declaration, benign packaging quirk for this package. | ai | |
| phantom-deps | phantom-dep:@types/lodash | AI (phantom-deps): @types/* phantom dep — TypeScript type declaration, benign packaging quirk for this package. | ai | |
| phantom-deps | phantom-dep:@types/mkdirp | AI (phantom-deps): @types/* phantom dep — TypeScript type declaration, benign packaging quirk for this package. | ai |
v1.2.3
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.2.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.2.1
9 findingsThis version was published by a different npm account than previous versions on 2022-05-03. This could indicate a legitimate maintainer transition or an account compromise.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.