← Home

iedriver

npm Repository Homepage

IEDriver for Selenium

25
Versions
Apache-2.0
License
Yes
Install Scripts
Missing
Provenance

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.

Maintainers

barretts

Keywords

iedriveriedriverserverselenium

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
provenance no-provenance AI (provenance): Long-established package (11+ years) with consistent publisher history; lack of Sigstore provenance is not a meaningful risk signal here. ai
dependencies unvetted-dep:request AI (dependencies): request is a well-known HTTP client; its use here is consistent with iedriver's documented purpose of downloading/verifying the IEDriverServer binary during install. ai
publish-pattern new-deps-added AI (publish-pattern): The added request dependency is a legitimate HTTP client needed for binary download/verification in this driver installer package. ai
license uncommon-license:Apache 2.0 AI (license): Apache 2.0 is a well-known permissive license; the analyzer's 'uncommon' flag is a false positive for this package. ai
install-scripts install-script:install AI (install-scripts): iedriver's install script downloads/extracts the IEDriverServer binary — standard pattern for Selenium WebDriver binary distribution packages. ai
semgrep semgrep:child-process-import AI (semgrep): child_process.execFile is used to launch IEDriverServer.exe — the intended functionality of this WebDriver launcher package. ai
npm-metadata bundled-binaries AI (npm-metadata): IEDriverServer.exe is the core deliverable of this package; bundling the Selenium IE WebDriver binary is its entire purpose. ai

Versions (showing 25 of 25)

Version Deps Published
4.0.0 6 / 0
3.150.1 6 / 0
3.14.1 8 / 0
3.9.2 8 / 0
3.9.1 7 / 0
3.9.0 7 / 0
3.6.0 7 / 0
3.5.0 7 / 0
3.4.0 6 / 0
3.3.0 6 / 0
3.2.0 6 / 0
3.1.0 6 / 0
3.0.0 6 / 0
2.53.1 6 / 0
2.53.0 6 / 0
2.52.2 6 / 0
2.52.0 6 / 0
2.51.0 6 / 0
2.50.0 6 / 0
2.49.0 6 / 0
2.48.0 6 / 0
2.47.0 6 / 0
2.46.0 6 / 0
2.45.1 6 / 0
2.1.1 6 / 0

v4.0.0

3 findings
HIGH Package has 'install' script install-scripts

Script: node install.js

HIGH Bundled binary files (1) npm-metadata

Package contains compiled binaries that could be backdoors: • lib/iedriver/IEDriverServer.exe

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.150.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.14.1

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.9.2

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.9.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.9.0

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.6.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.5.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.4.0

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.3.0

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.2.0

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.1.0

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.0.0

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.