fibers
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| provenance | no-provenance | AI (provenance): fibers is a 15-year-old established native addon; lack of Sigstore provenance is expected for packages of this age and does not indicate risk. | ai | |
| dependencies | unvetted-dep:detect-libc | AI (dependencies): detect-libc is used to select the correct pre-built binary (glibc vs musl); legitimate and expected dependency for this native addon. | ai | |
| semgrep | semgrep:child-process-import | AI (semgrep): child_process is used solely in build.js to invoke node-gyp for native compilation. No malicious use pattern present. | ai | |
| install-scripts | install-script:install | AI (install-scripts): fibers is a native addon; install script invokes node-gyp via build.js to compile C++ bindings. This is the documented, expected build flow for this package. | ai | |
| semgrep | semgrep:dynamic-require | AI (semgrep): Dynamic require loads the platform-specific prebuilt .node binary at runtime — standard pattern for cross-platform native addons. | ai | |
| semgrep | semgrep:child-process-spawn | AI (semgrep): spawn is used to run node-gyp rebuild in build.js — standard native addon build pattern. | ai | |
| npm-metadata | bundled-binaries | AI (npm-metadata): Pre-built .node binaries for multiple platforms are standard distribution for native addons, allowing users to skip compilation. Expected for fibers. | ai |
Versions (showing 5 of 5)
| Version | Deps | Published |
|---|---|---|
| 5.0.3 | 1 / 0 | |
| 5.0.0 | 1 / 0 | |
| 4.0.2 | 1 / 0 | |
| 4.0.1 | 1 / 0 | |
| 4.0.0 | 1 / 0 |
v5.0.3
3 findingsScript: node build.js || nodejs build.js
Package contains compiled binaries that could be backdoors: • bin/darwin-arm64-108/fibers.node • bin/darwin-x64-72/fibers.node • bin/darwin-x64-83/fibers.node • bin/linux-x64-72-glibc/fibers.node • bin/linux-x64-72-musl/fibers.node • bin/linux-x64-83-glibc/fibers.node • bin/linux-x64-83-musl/fibers.node • bin/win32-x64-72/fibers.node • bin/win32-x64-83/fibers.node • build/Release/obj.target/fibers/src/libcoro/coro.o ... and 2 more
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.0.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.0.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.0.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.0.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.