prebuild
A command line tool for easily making prebuilt binaries for multiple versions of node, electron or node-webkit on a specific platform
17
Versions
MIT
License
No
Install Scripts
Missing
Provenance
Supply chain provenance
Status for the latest visible version.
No SLSA provenance
npm registry signatures
gitHead linked
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
lovellvweeversjuliangrubermafintoshralphtheninja
Keywords
prebuiltbinariesnativeaddonmodulecc++bindingsdevopselectronnode-webkitnode-api
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| provenance | publisher-changed | AI (provenance): lovell is the maintainer of sharp, a primary consumer of prebuild, and a well-established npm publisher. The transition from ralphtheninja is a legitimate ecosystem handoff. | ai | |
| maintainer-change | maintainer-added | AI (maintainer-change): lovell added as maintainer is consistent with their role as a major stakeholder in the native addon ecosystem; not a suspicious takeover. | ai | |
| semgrep | semgrep:child-process-import | AI (semgrep): prebuild is a native addon build tool; spawning child processes (node-gyp, cmake-js, etc.) is its core documented function. | ai | |
| semgrep | semgrep:child-process-spawn | AI (semgrep): Same rationale — spawning build processes is the package's primary purpose. | ai | |
| semgrep | semgrep:dynamic-require | AI (semgrep): require(path.resolve('package.json')) is a standard pattern for reading the consuming project's metadata at build time; not a security risk. | ai | |
| phantom-deps | phantom-dep:cmake-js | AI (phantom-deps): cmake-js is a listed runtime dependency used as an optional build backend; referenced in config rather than directly imported is expected. | ai |