postgres
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| semgrep | semgrep:base64-decode | AI (semgrep): Base64 decoding is used for SCRAM-SHA-256 authentication (decoding server salt) — standard PostgreSQL protocol behavior, not a malicious payload. | ai | |
| semgrep | semgrep:hex-decode | AI (semgrep): Hex decoding is used to parse PostgreSQL LSN (Log Sequence Number) values in the replication/subscribe feature — standard protocol behavior. | ai | |
| provenance | no-provenance | AI (provenance): Established package (4132 days old, 48 versions); lack of Sigstore provenance is common and not a risk signal here. | ai |
v3.4.9
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v3.4.8
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v3.4.7
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v3.4.6
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.