node-gyp
Node.js native addon build tool
Supply chain provenance
Status for the latest visible version.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| dependencies | unvetted-dep:path-array | AI (dependencies): path-array is a legitimate PATH-management utility appropriate for node-gyp's build tool use case; no malicious signals. | ai | |
| provenance | no-provenance | AI (provenance): Established package with 5189 days history; provenance absence is common and not material for this context. | ai | |
| dependencies | unvetted-dep:request | AI (dependencies): request was ubiquitous HTTP client in 2013–2014; expected for build tools fetching resources. | ai | |
| maintainer-change | maintainer-added | AI (maintainer-change): Addition of nodejs-foundation reflects official Node.js project governance; stable for this package. | ai | |
| maintainer-change | maintainer-removed | AI (maintainer-change): Removal of prior maintainers is part of legitimate governance transition; combined with nodejs-foundation addition, not a takeover. | ai | |
| provenance | publisher-changed | AI (provenance): Legitimate maintainer transition to nodejs-foundation stewardship; lukekarrys has strong track record. | ai | |
| bogus-package | bogus-package | AI (bogus-package): Spam signal references isaacs, not current publisher rvagg. rvagg has strong track record (618 approved packages). False positive for this package. | ai | |
| dependencies | unvetted-dep:undici | AI (dependencies): undici is Node.js's official HTTP client; its use in node-gyp is appropriate and stable. | ai | |
| publish-pattern | new-deps-added | AI (publish-pattern): Undici is a Node.js project-maintained HTTP client replacing make-fetch-happen; well-vetted and appropriate for this package. | ai | |
| semgrep | semgrep:child-process-import | AI (semgrep): child_process imports are essential for node-gyp's core function of executing build commands; legitimate for this package. | ai | |
| semgrep | semgrep:dynamic-require | AI (semgrep): Dynamic require of command modules is node-gyp's documented command dispatch pattern; stable for this package. | ai | |
| dependencies | unvetted-dep:env-paths | AI (dependencies): env-paths dependency is long-standing in node-gyp; accepted risk for this package. | ai | |
| dependencies | unvetted-dep:make-fetch-happen | AI (dependencies): make-fetch-happen is an npm-maintained fetch library used for downloading Node.js headers; expected dependency for node-gyp. | ai | |
| semgrep | semgrep:env-bulk-read | AI (semgrep): Reading npm_config_* environment variables is standard npm integration; expected for build tools. | ai | |
| dependencies | unvetted-dep:proc-log | AI (dependencies): proc-log is a standard npm ecosystem logging utility; expected dependency for Node.js tooling. | ai | |
| semgrep | semgrep:child-process-spawn | AI (semgrep): child_process.spawn is core to node-gyp's build execution; legitimate and necessary. | ai | |
| dependencies | unvetted-dep:exponential-backoff | AI (dependencies): exponential-backoff is a standard retry utility; expected in network-fetching tooling like node-gyp. | ai |
Versions (showing 39 of 39)
| Version | Deps | Published |
|---|---|---|
| 12.3.0 | 10 / 7 | |
| 12.2.0 | 10 / 7 | |
| 12.1.0 | 10 / 7 | |
| 12.0.0 | 10 / 7 | |
| 11.5.0 | 10 / 7 | |
| 11.4.2 | 10 / 7 | |
| 11.4.1 | 10 / 7 | |
| 11.3.0 | 10 / 7 | |
| 11.2.0 | 10 / 7 | |
| 11.1.0 | 10 / 7 | |
| 11.0.0 | 10 / 7 | |
| 10.3.1 | 10 / 6 | |
| 10.3.0 | 10 / 6 | |
| 10.2.0 | 10 / 6 | |
| 10.1.0 | 10 / 6 | |
| 10.0.1 | 10 / 6 | |
| 10.0.0 | 10 / 6 | |
| 9.4.1 | 11 / 5 | |
| 9.4.0 | 11 / 5 | |
| 9.3.1 | 10 / 5 | |
| 9.3.0 | 10 / 5 | |
| 9.2.0 | 10 / 5 | |
| 9.1.0 | 10 / 5 | |
| 9.0.0 | 10 / 5 | |
| 8.4.1 | 10 / 5 | |
| 8.4.0 | 10 / 5 | |
| 8.3.0 | 10 / 5 | |
| 8.2.0 | 10 / 5 | |
| 8.1.0 | 10 / 5 | |
| 8.0.0 | 10 / 5 | |
| 5.0.4 | 11 / 5 | |
| 5.0.0 | 11 / 6 | |
| 3.6.3 | 13 / 4 | |
| 3.4.0 | 14 / 4 | |
| 3.0.3 | 14 / 1 | |
| 3.0.2 | 14 / 1 | |
| 3.0.1 | 14 / 1 | |
| 1.0.1 | 13 / 0 | |
| 0.6.5 | 13 / 0 |
v12.3.0
2 findingsPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
[Accepted risk] This version was published by a different npm account than previous versions on 2026-04-21. This could indicate a legitimate maintainer transition or an account compromise.
v12.2.0
2 findingsPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
[Accepted risk] This version was published by a different npm account than previous versions on 2026-01-27. This could indicate a legitimate maintainer transition or an account compromise.
v12.1.0
2 findingsPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
[Accepted risk] This version was published by a different npm account than previous versions on 2025-11-12. This could indicate a legitimate maintainer transition or an account compromise.
v12.0.0
2 findingsPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
[Accepted risk] This version was published by a different npm account than previous versions on 2025-11-11. This could indicate a legitimate maintainer transition or an account compromise.
v11.5.0
2 findingsPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
[Accepted risk] This version was published by a different npm account than previous versions on 2025-10-15. This could indicate a legitimate maintainer transition or an account compromise.
v11.4.2
2 findingsPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
[Accepted risk] This version was published by a different npm account than previous versions on 2025-08-26. This could indicate a legitimate maintainer transition or an account compromise.
v11.4.1
2 findingsPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
[Accepted risk] This version was published by a different npm account than previous versions on 2025-08-20. This could indicate a legitimate maintainer transition or an account compromise.
v11.3.0
2 findingsThis version was published by a different npm account than previous versions on 2025-07-30. This could indicate a legitimate maintainer transition or an account compromise.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v11.2.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v11.1.0
2 findingsPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
[Accepted risk] This version was published by a different npm account than previous versions on 2025-02-10. This could indicate a legitimate maintainer transition or an account compromise.
v11.0.0
2 findingsPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
[Accepted risk] This version was published by a different npm account than previous versions on 2024-12-04. This could indicate a legitimate maintainer transition or an account compromise.
v10.3.1
2 findingsPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
[Accepted risk] This version was published by a different npm account than previous versions on 2024-12-02. This could indicate a legitimate maintainer transition or an account compromise.
v10.3.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v10.2.0
2 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2024-07-10. This could indicate a legitimate maintainer transition or an account compromise.
v10.1.0
2 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2024-03-25. This could indicate a legitimate maintainer transition or an account compromise.
v10.0.1
2 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2023-11-02. This could indicate a legitimate maintainer transition or an account compromise.
v10.0.0
2 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2023-10-28. This could indicate a legitimate maintainer transition or an account compromise.
v9.4.1
2 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2023-10-27. This could indicate a legitimate maintainer transition or an account compromise.
v9.4.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v9.3.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.3.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v9.2.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.1.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.0.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v8.4.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v8.4.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v8.3.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v8.2.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v8.1.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v8.0.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.0.4
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.0.0
2 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2019-06-13. This could indicate a legitimate maintainer transition or an account compromise.
v3.6.3
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v3.4.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v3.0.3
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v3.0.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v3.0.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.6.5
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.