grpc

gRPC Library for Node

Supply chain provenance

Status for the latest visible version.

Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.

Maintainers

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
semgrep	semgrep:base64-decode	AI (semgrep): Base64 decode in credentials.js is standard PEM certificate parsing (DER extraction for TLS), not a malicious payload pattern.	ai	2026/04/22
semgrep	semgrep:dynamic-require	AI (semgrep): Dynamic require in grpc_extension.js loads the native .node binary at a node-pre-gyp computed path; standard native addon loading pattern.	ai	2026/04/22
phantom-deps	phantom-dep:nan	AI (phantom-deps): nan is a native addon build-time dependency referenced in binding.gyp, not a JS import; phantom-dep false positive for native addons.	ai	2026/04/22
phantom-deps	phantom-dep:@types/bytebuffer	AI (phantom-deps): @types/bytebuffer is a TypeScript type definition loaded by convention, not direct JS import; expected phantom-dep false positive.	ai	2026/04/22
install-scripts	install-script:install	AI (install-scripts): node-pre-gyp install is the standard native addon binary fetch pattern for gRPC's C-core binding; stable across all versions of this package.	ai	2026/04/21

Version	Deps	Published
1.24.11	6 / 9	2021-07-23