← Home

napi-postinstall

npm Repository Homepage

The `postinstall` script helper for handling native bindings in legacy `npm` versions

5
Versions
MIT
License
No
Install Scripts
Verified
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures gitHead linked

Maintainers

jounqin

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
semgrep semgrep:env-spread AI (semgrep): Spreads env only to unset npm_config_global for child npm install; standard native-binding helper pattern. ai
semgrep semgrep:dynamic-require AI (semgrep): Requires package.json and resolved platform-specific bindings; not arbitrary user input. ai

Versions (showing 5 of 5)

Version Deps Published
0.3.4 0 / 0
0.3.3 0 / 0
0.3.2 0 / 0
0.3.0 0 / 0
0.2.5 0 / 0

v0.3.4

2 findings
HIGH env-spread: lib/index.js:66 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/un-ts/napi-postinstall/blob/95a44d2c79e875a6207ef0a0de05ebfc29922000/lib/index.js#L66 64 | function installUsingNPM(hostPkg, pkg, version, target, subpath, nodePath) { 65 | const isWasm32Wasi = target === constants_js_1.WASM32_WASI; > 66 | const env = { ...process.env, npm_config_global: undefined }; 67 | const pkgDir = path.dirname(require.resolve(hostPkg + `/${constants_js_1.PACKAGE_JSON}`)); 68 | const installDir = path.join(pkgDir, 'npm-install');

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.3.3

2 findings
HIGH env-spread: lib/index.js:66 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/un-ts/napi-postinstall/blob/ac8c14d39a3b3680da3bb88b9f2d8622a1103b82/lib/index.js#L66 64 | function installUsingNPM(hostPkg, pkg, version, target, subpath, nodePath) { 65 | const isWasm32Wasi = target === constants_js_1.WASM32_WASI; > 66 | const env = { ...process.env, npm_config_global: undefined }; 67 | const pkgDir = path.dirname(require.resolve(hostPkg + `/${constants_js_1.PACKAGE_JSON}`)); 68 | const installDir = path.join(pkgDir, 'npm-install');

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.3.2

2 findings
HIGH env-spread: lib/index.js:64 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/un-ts/napi-postinstall/blob/38b4e95cf554e2549b9e1e2c4ff6bff4da9a65f9/lib/index.js#L64 62 | function installUsingNPM(hostPkg, pkg, version, target, subpath, nodePath) { 63 | const isWasm32Wasi = target === constants_js_1.WASM32_WASI; > 64 | const env = { ...process.env, npm_config_global: undefined }; 65 | const pkgDir = path.dirname(require.resolve(hostPkg + `/${constants_js_1.PACKAGE_JSON}`)); 66 | const installDir = path.join(pkgDir, 'npm-install');

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.3.0

2 findings
HIGH env-spread: lib/index.js:64 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/un-ts/napi-postinstall/blob/135b1e93bd783cff9d0eca400643daca3ecdbd01/lib/index.js#L64 62 | function installUsingNPM(hostPkg, pkg, version, target, subpath, nodePath) { 63 | const isWasm32Wasi = target === constants_js_1.WASM32_WASI; > 64 | const env = { ...process.env, npm_config_global: undefined }; 65 | const pkgDir = path.dirname(require.resolve(hostPkg + `/${constants_js_1.PACKAGE_JSON}`)); 66 | const installDir = path.join(pkgDir, 'npm-install');

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.2.5

2 findings
HIGH env-spread: lib/index.js:64 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/un-ts/napi-postinstall/blob/254b7401c6b84c4dc5723de054cccae21b1c5aa3/lib/index.js#L64 62 | function installUsingNPM(hostPkg, pkg, version, target, subpath, nodePath) { 63 | const isWasm32Wasi = target === constants_js_1.WASM32_WASI; > 64 | const env = { ...process.env, npm_config_global: undefined }; 65 | const pkgDir = path.dirname(require.resolve(hostPkg + `/${constants_js_1.PACKAGE_JSON}`)); 66 | const installDir = path.join(pkgDir, 'npm-install');

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.