relay-compiler
A compiler tool for building GraphQL-driven applications.
74
Versions
MIT
License
No
Install Scripts
Verified
Provenance
Supply chain provenance
Status for the latest visible version.
SLSA provenance attestation
npm registry signatures
gitHead linked
Maintainers
fbyuzhirelay-bot
Keywords
graphqlrelay
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| semgrep | semgrep:eval-usage | AI (semgrep): eval('require') is a documented pattern in relay-compiler for optional dynamic require of relay-config, wrapped in try/catch. Not malicious — stable across versions. | ai | |
| semgrep | semgrep:child-process-spawn | AI (semgrep): Spawning 'watchman version' is core relay-compiler functionality for Watchman file-watching integration. Expected and stable for this package. | ai | |
| npm-metadata | bundled-binaries | AI (npm-metadata): relay-compiler ships platform-specific native binaries (Rust-compiled) as its core distribution mechanism; bundled binaries are expected and stable for this package. | ai | |
| semgrep | semgrep:child-process-import | AI (semgrep): cli.js uses child_process.spawn to invoke the bundled native binary — standard pattern for npm-wrapped native executables; stable false positive for this package. | ai | |
| bogus-package | bogus-package | AI (bogus-package): The 'fb' maintainer flag is a false positive — fb is the official Facebook/Meta npm account used for the Relay ecosystem, not a spam publisher. | ai |