phantomjs-prebuilt
Headless WebKit with JS API
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| publish-pattern | new-deps-added | AI (publish-pattern): es6-promise is a well-known, benign Promise polyfill with no malicious history; not a meaningful attack vector for this package. | ai | |
| maintainer-change | maintainer-added | AI (maintainer-change): New maintainers dpup and medium are Dan Pupius and Medium org — directly tied to the package's own GitHub repo and author field. Legitimate organizational addition, not a suspicious takeover. | ai | |
| source-diff | source-size-tripled | AI (source-diff): 88x size increase is fully explained by bundling request and its transitive dependencies directly into the tarball. No obfuscation or malicious payload present. | ai | |
| source-diff | large-new-source-files | AI (source-diff): Size increase is due to vendored/bundled runtime dependencies (request and transitive deps), a known pattern for phantomjs-prebuilt. Not injected malicious code. | ai | |
| dependencies | unvetted-dep:request | AI (dependencies): request is a well-known HTTP client used to download prebuilt binaries; appropriate for this package's age and purpose. | ai | |
| install-scripts | install-script:install | AI (install-scripts): phantomjs-prebuilt's install script downloads prebuilt PhantomJS binaries; this is the package's documented and expected install flow. | ai | |
| provenance | no-provenance | AI (provenance): Legacy package predates Sigstore provenance; not a risk signal for established packages. | ai | |
| semgrep | semgrep:dynamic-require | AI (semgrep): Dynamic require loads platform-specific config by path in lib/util.js; standard pattern for this package. | ai | |
| semgrep | semgrep:child-process-import | AI (semgrep): child_process is used in install.js to verify the downloaded PhantomJS binary; standard for prebuilt binary packages. | ai |
v2.1.10
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.1.9
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.1.7
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.1.4
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.