← Home

node-hooks

npm Repository

An NPM for git hooks.

7
Versions
MIT
License
Yes
Install Scripts
Missing
Provenance

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures No source commit

Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.

Maintainers

mcwhittemore

Keywords

githooks

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
dependencies unvetted-dep:request AI (dependencies): request is a well-known, canonical npm HTTP library. Its use here is consistent with the package's purpose and poses no malicious risk. ai
phantom-deps phantom-dep:commands AI (phantom-deps): The 'commands' reference is a local directory (../commands/) used via dynamic require for CLI dispatch, not the npm 'commands' package. Stable false positive for this package. ai
provenance no-provenance AI (provenance): Package is 4600+ days old with a strong publisher track record. Lack of Sigstore provenance is a best-practice gap, not a security risk for this established package. ai
install-scripts install-script:postinstall AI (install-scripts): node-hooks is a git hooks manager; postinstall running 'node ./bin/hooks install' is the package's core documented purpose, not a malicious payload. ai
semgrep semgrep:dynamic-require AI (semgrep): Dynamic require is used for command dispatch from a validated allowlist (commands.indexOf check + vanity_routes). Standard CLI dispatch pattern for this tool. ai
semgrep semgrep:child-process-import AI (semgrep): child_process is expected in a git hooks manager that must execute shell commands to install hooks into the consuming project. ai

Versions (showing 7 of 7)

Version Deps Published
0.0.14 3 / 4
0.0.13 3 / 4
0.0.9 2 / 2
0.0.8 1 / 2
0.0.6 1 / 2
0.0.5 1 / 2
0.0.4 2 / 2

v0.0.14

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.13

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.9

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.8

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.6

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.5

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.4

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.