← Home

pangyp

npm Repository Homepage

Node.js and io.js native addon build tool

9
Versions
—
License
No
Install Scripts
Missing
Provenance

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.

Maintainers

rvagg

Keywords

nativeaddonmodulecc++bindingsgyp

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
semgrep semgrep:child-process-import AI (semgrep): pangyp is a native addon build tool; invoking child processes to run compilers and build systems is its core function, not a risk. ai
semgrep semgrep:child-process-spawn AI (semgrep): Spawning processes is fundamental to pangyp's purpose as a build tool for native Node.js addons. ai
semgrep semgrep:dynamic-require AI (semgrep): Dynamic require is used for command dispatch loading known subcommand modules from the same directory — a stable, bounded pattern. ai
semgrep semgrep:env-bulk-read AI (semgrep): Reads only npm_config_-prefixed env vars to inherit npm configuration, which is the documented and expected behavior for node-gyp-style tools. ai
dependencies unvetted-dep:request AI (dependencies): request is a well-known HTTP library used here to download Node.js headers during build setup — appropriate for a build tool. ai

Versions (showing 9 of 9)

Version Deps Published
2.3.3 13 / 2
2.3.2 13 / 2
2.3.1 13 / 2
2.3.0 13 / 2
2.2.1 13 / 2
2.2.0 13 / 2
2.1.0 13 / 2
2.0.2 13 / 2
2.0.0 13 / 2

v2.3.3

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.3.2

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.3.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.3.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.2.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.2.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.1.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.0.2

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.0.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.