farmhash — Greenflagged

Node-API implementation of FarmHash, Google's family of very fast hash functions

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures gitHead linked

lovell

farmhashhashcityhashmurmurhashfingerprint

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
install-scripts	install-script:install	AI (install-scripts): Standard native addon install pattern (prebuild-install \|\| node-gyp rebuild); stable for this package.	ai	2026/05/21
phantom-deps	phantom-dep:node-addon-api	AI (phantom-deps): node-addon-api is used via binding.gyp at build time, not via JS import.	ai	2026/05/21
phantom-deps	phantom-dep:prebuild-install	AI (phantom-deps): prebuild-install is invoked from install script, not imported in JS.	ai	2026/05/21
npm-metadata	bundled-binaries	AI (npm-metadata): Prebuilt platform-specific .node binaries are the standard distribution mechanism for this native addon. SLSA provenance attestation confirms they were built from the official source repo.	ai	2026/04/21
semgrep	semgrep:dynamic-require	AI (semgrep): Dynamic require is used solely to load the correct platform-specific .node binary — a standard and expected pattern for cross-platform native addons.	ai	2026/04/21
dependencies	unvetted-dep:detect-libc	AI (dependencies): detect-libc is a well-known utility for detecting glibc vs musl on Linux, legitimately used by native addon packages to select the correct binary.	ai	2026/04/21

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

2 findings

HIGH Package has 'install' script install-scripts

Script: prebuild-install || node-gyp rebuild

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.