relay-compiler
A compiler tool for building GraphQL-driven applications.
Supply chain provenance
Status for the latest visible version.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| semgrep | semgrep:eval-usage | AI (semgrep): eval('require') is a documented pattern in relay-compiler for optional dynamic require of relay-config, wrapped in try/catch. Not malicious — stable across versions. | ai | |
| semgrep | semgrep:child-process-spawn | AI (semgrep): Spawning 'watchman version' is core relay-compiler functionality for Watchman file-watching integration. Expected and stable for this package. | ai | |
| npm-metadata | bundled-binaries | AI (npm-metadata): relay-compiler ships platform-specific native binaries (Rust-compiled) as its core distribution mechanism; bundled binaries are expected and stable for this package. | ai | |
| semgrep | semgrep:child-process-import | AI (semgrep): cli.js uses child_process.spawn to invoke the bundled native binary — standard pattern for npm-wrapped native executables; stable false positive for this package. | ai | |
| bogus-package | bogus-package | AI (bogus-package): The 'fb' maintainer flag is a false positive — fb is the official Facebook/Meta npm account used for the Relay ecosystem, not a spam publisher. | ai |
Versions (showing 100 of 174)
v21.0.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v21.0.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v20.1.1
2 findingsPackage contains compiled binaries that could be backdoors: • macos-arm64/relay • macos-x64/relay • win-x64/relay.exe
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v20.1.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v20.0.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v19.0.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v18.2.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v18.1.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v18.0.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v17.0.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v9.1.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.