firebase
Firebase JavaScript library for web and Node.js
51
Versions
Apache-2.0
License
No
Install Scripts
Missing
Provenance
Supply chain provenance
Status for the latest visible version.
No SLSA provenance
npm registry signatures
gitHead linked
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
firebase-opsfeiyang.chengoogle-wombotchholland
Keywords
authenticationdatabaseFirebasefirebaserealtimestorageperformanceremote-config
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | obfuscated-file:firebase-vertexai-preview.js | AI (source-diff): Standard minified Firebase ESM bundle for the Vertex AI preview module; imports from Google CDN, defines standard Firebase classes. Expected for this package. | ai | |
| source-diff | obfuscated-file:firebase-vertexai.js | AI (source-diff): Minified JavaScript is standard for production SDK bundles; sample shows legitimate Firebase code, not obfuscation for concealment. | ai | |
| source-diff | obfuscated-file:firebase-data-connect.js | AI (source-diff): Minified ES6 module code from Firebase's build process; standard for SDK distribution. Code is readable as legitimate Firebase logic. | ai | |
| publish-pattern | new-deps-added | AI (publish-pattern): New @firebase/ai dependency is a legitimate first-party Google Firebase sub-package for the Firebase AI Logic feature, consistent with Google's documented SDK roadmap. | ai | |
| source-diff | obfuscated-file:firebase-firestore-pipelines.js | AI (source-diff): Minified Firestore pipeline code; standard for production builds. No malicious patterns detected. | ai | |
| source-diff | large-new-source-files | AI (source-diff): Firebase SDK regularly adds new modules/features across minor versions; large file counts are normal for this umbrella package. | ai | |
| source-diff | obfuscated-file:firebase-firestore-lite-pipelines.js | AI (source-diff): Minified Firestore Lite pipeline code; standard for production builds. No malicious patterns detected. | ai | |
| source-diff | obfuscated-file:firebase-ai.js | AI (source-diff): Minified Firebase AI module code; standard for production builds. No malicious patterns detected. | ai | |
| dependencies | unvetted-dep:@firebase/app-check-compat | AI (dependencies): Firebase internal dependency; Google-controlled monorepo component, stable across versions. | ai | |
| dependencies | unvetted-dep:@firebase/firestore-compat | AI (dependencies): Firebase internal dependency; Google-controlled monorepo component, stable across versions. | ai | |
| dependencies | unvetted-dep:@firebase/functions-compat | AI (dependencies): Firebase internal dependency; Google-controlled monorepo component, stable across versions. | ai | |
| dependencies | unvetted-dep:@firebase/remote-config-compat | AI (dependencies): Firebase internal dependency; Google-controlled monorepo component, stable across versions. | ai | |
| dependencies | unvetted-dep:@firebase/analytics-compat | AI (dependencies): Firebase internal dependency; Google-controlled monorepo component, stable across versions. | ai | |
| dependencies | unvetted-dep:@firebase/auth-compat | AI (dependencies): Firebase internal dependency; Google-controlled monorepo component, stable across versions. | ai | |
| dependencies | unvetted-dep:@firebase/installations | AI (dependencies): Firebase internal dependency; Google-controlled monorepo component, stable across versions. | ai | |
| dependencies | unvetted-dep:@firebase/storage-compat | AI (dependencies): Firebase internal dependency; Google-controlled monorepo component, stable across versions. | ai | |
| dependencies | unvetted-dep:@firebase/messaging-compat | AI (dependencies): Firebase internal dependency; Google-controlled monorepo component, stable across versions. | ai | |
| dependencies | unvetted-dep:@firebase/util | AI (dependencies): Firebase internal dependency; Google-controlled monorepo component, stable across versions. | ai | |
| dependencies | unvetted-dep:@firebase/storage | AI (dependencies): Firebase internal dependency; Google-controlled monorepo component, stable across versions. | ai | |
| dependencies | unvetted-dep:@firebase/database | AI (dependencies): Firebase internal dependency; Google-controlled monorepo component, stable across versions. | ai | |
| dependencies | unvetted-dep:@firebase/app-types | AI (dependencies): Firebase internal dependency; Google-controlled monorepo component, stable across versions. | ai | |
| dependencies | unvetted-dep:@firebase/functions | AI (dependencies): Firebase internal dependency; Google-controlled monorepo component, stable across versions. | ai | |
| dependencies | unvetted-dep:@firebase/messaging | AI (dependencies): Firebase internal dependency; Google-controlled monorepo component, stable across versions. | ai | |
| dependencies | unvetted-dep:@firebase/app-compat | AI (dependencies): Firebase internal dependency; Google-controlled monorepo component, stable across versions. | ai | |
| provenance | no-provenance | AI (provenance): Firebase SDK published by Google's bot account; lack of Sigstore provenance is not a risk signal for this publisher. | ai | |
| phantom-deps | phantom-dep:@firebase/app-types | AI (phantom-deps): Internal Firebase dependency referenced in config; expected for modular architecture. | ai | |
| phantom-deps | phantom-dep:@firebase/util | AI (phantom-deps): Internal Firebase dependency referenced in config; expected for modular architecture. | ai | |
| semgrep | semgrep:toplevel-fetch | AI (semgrep): Firebase SDK legitimately uses fetch() to communicate with Firebase services. All 56 hits are in bundled compat modules; expected for this package. | ai |
Versions (showing 51 of 52)
| Version | Deps | Published |
|---|---|---|
| 12.14.0 | 28 / 12 | |
| 12.13.0 | 28 / 12 | |
| 12.12.1 | 28 / 12 | |
| 12.12.0 | 28 / 12 | |
| 12.11.0 | 28 / 12 | |
| 12.10.0 | 28 / 12 | |
| 12.9.0 | 28 / 12 | |
| 12.8.0 | 28 / 12 | |
| 12.7.0 | 28 / 12 | |
| 12.6.0 | 28 / 12 | |
| 12.5.0 | 28 / 12 | |
| 12.4.0 | 28 / 12 | |
| 12.3.0 | 28 / 12 | |
| 12.2.1 | 28 / 12 | |
| 12.2.0 | 28 / 12 | |
| 12.1.0 | 28 / 12 | |
| 12.0.0 | 28 / 12 | |
| 11.10.0 | 28 / 12 | |
| 11.9.1 | 28 / 12 | |
| 11.9.0 | 28 / 12 | |
| 11.8.1 | 28 / 12 | |
| 11.8.0 | 28 / 12 | |
| 11.7.3 | 28 / 12 | |
| 11.7.2 | 28 / 12 | |
| 11.7.1 | 28 / 12 | |
| 11.7.0 | 28 / 12 | |
| 11.6.1 | 28 / 12 | |
| 11.6.0 | 28 / 12 | |
| 11.5.0 | 28 / 12 | |
| 11.4.0 | 28 / 12 | |
| 11.3.1 | 28 / 12 | |
| 11.3.0 | 28 / 12 | |
| 11.2.0 | 28 / 12 | |
| 11.1.0 | 28 / 12 | |
| 11.0.2 | 28 / 12 | |
| 11.0.1 | 28 / 12 | |
| 11.0.0 | 28 / 12 | |
| 10.14.1 | 28 / 12 | |
| 10.14.0 | 28 / 12 | |
| 10.13.2 | 27 / 12 | |
| 10.13.1 | 27 / 12 | |
| 10.13.0 | 27 / 12 | |
| 10.12.5 | 27 / 12 | |
| 10.12.4 | 27 / 12 | |
| 10.12.3 | 27 / 12 | |
| 10.12.2 | 27 / 12 | |
| 10.12.1 | 27 / 12 | |
| 10.12.0 | 27 / 12 | |
| 10.11.1 | 26 / 12 | |
| 10.11.0 | 26 / 12 | |
| 10.10.0 | 26 / 12 |
v12.14.0
1 finding
INFO
No provenance attestation
provenance
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v12.13.0
1 finding
INFO
No provenance attestation
provenance
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.