← Home

elastic-apm-node

npm Repository Homepage
2
Versions
—
License
No
Install Scripts
Verified
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures gitHead linked

Maintainers

trentmelasticmachineobltmachine

Keywords

opbeatelasticelasticapmelasticsearchlogloggingbugbugserrorerrorsexceptionexceptionscatchmonitormonitoringalertalertsperformanceapmopsdevopsstacktracetracetracingdistributedtracingdistributed-tracing

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
semgrep semgrep:dynamic-require AI (semgrep): Reads the host app's own package.json for metadata; not arbitrary module loading. ai
semgrep semgrep:child-process-import AI (semgrep): Used only for hostname detection via spawnSync; documented APM agent behavior. ai
semgrep semgrep:shady-links-raw-ip AI (semgrep): 127.0.0.1:8200 is the default local APM server address; not exfiltration. ai
semgrep semgrep:base64-decode AI (semgrep): Decodes inline source maps; standard source-map processing. ai
semgrep semgrep:hex-decode AI (semgrep): Parses W3C trace-context binary format; standard tracing protocol handling. ai
phantom-deps phantom-dep:module-details-from-path AI (phantom-deps): Listed as runtime dep in package.json; phantom-dep heuristic false positive for this package. ai

Versions (showing 2 of 2)

Version Deps Published
4.15.0 37 / 81
4.14.0 37 / 81

v4.15.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v4.14.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.