electron-download
download electron prebuilt binary zips from github releases
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| dependencies | unvetted-dep:env-paths | AI (dependencies): env-paths is a well-known Sindre Sorhus utility for OS-standard paths; its use in electron-download for cache directory resolution is appropriate and benign. | ai | |
| provenance | publisher-changed | AI (provenance): marshallofsound is a known Electron core maintainer; the transition from kevinsawicki within the electron-userland org is a documented legitimate handoff. | ai | |
| maintainer-change | maintainer-added | AI (maintainer-change): marshallofsound (Samuel Attard) is a recognized Electron maintainer; addition is a legitimate org-level transition. | ai | |
| maintainer-change | maintainer-removed | AI (maintainer-change): maxogden removal is part of the same documented electron-userland maintainer transition; no compromise indicators. | ai | |
| publish-pattern | dormant-publish | AI (publish-pattern): Dormancy aligns with the maintainer transition timeline within the electron-userland org; not indicative of account takeover. | ai | |
| semgrep | semgrep:child-process-import | AI (semgrep): execSync in lib/arch.js is used to detect system architecture for platform-specific binary downloads — expected and legitimate for this package. | ai |
Versions (showing 29 of 29)
| Version | Deps | Published |
|---|---|---|
| 4.1.1 | 9 / 9 | |
| 4.1.0 | 9 / 7 | |
| 4.0.0 | 8 / 7 | |
| 3.3.0 | 9 / 10 | |
| 3.2.0 | 9 / 10 | |
| 3.1.0 | 9 / 9 | |
| 3.0.2 | 9 / 9 | |
| 3.0.1 | 9 / 8 | |
| 3.0.0 | 9 / 8 | |
| 2.2.1 | 8 / 1 | |
| 2.2.0 | 9 / 4 | |
| 2.1.2 | 8 / 1 | |
| 2.1.1 | 8 / 1 | |
| 2.1.0 | 8 / 1 | |
| 2.0.0 | 8 / 1 | |
| 1.4.1 | 8 / 1 | |
| 1.4.0 | 8 / 1 | |
| 1.3.0 | 7 / 1 | |
| 1.2.0 | 7 / 1 | |
| 1.1.0 | 7 / 1 | |
| 1.0.8 | 6 / 1 | |
| 1.0.7 | 6 / 1 | |
| 1.0.6 | 6 / 1 | |
| 1.0.5 | 5 / 1 | |
| 1.0.4 | 5 / 0 | |
| 1.0.3 | 4 / 0 | |
| 1.0.2 | 4 / 0 | |
| 1.0.1 | 4 / 0 | |
| 1.0.0 | 4 / 0 |
v4.1.1
2 findingsThis version was published by a different npm account than previous versions on 2018-08-16. This could indicate a legitimate maintainer transition or an account compromise.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.1.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.0.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.3.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.2.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.1.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.0.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.0.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.0.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.