← Home

runsync

npm Repository Homepage

Polyfill of spawnSync and execSync for Node-0.10.x (Unix only yet)

3
Versions
MIT
License
Yes
Install Scripts
Missing
Provenance

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.

Maintainers

norahiko

Keywords

runchild_processprocessspawnspawnSyncexecexecSyncpolyfill

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
install-scripts install-script:install AI (install-scripts): runsync is a native addon (gypfile:true, nan dependency); install script runs node-gyp rebuild via build.js — standard native module build pattern. ai
semgrep semgrep:child-process-import AI (semgrep): Package's core purpose is to polyfill spawnSync/execSync; child_process import is fundamental to its design, not malicious. ai
semgrep semgrep:child-process-spawn AI (semgrep): spawn() in build.js is used solely to invoke node-gyp rebuild during native addon compilation — expected and benign. ai
phantom-deps phantom-dep:nan AI (phantom-deps): nan is a native addon dependency used via binding.gyp config, not via require(); phantom-dep detection is a false positive for native modules. ai

Versions (showing 3 of 3)

Version Deps Published
0.1.8 1 / 5
0.1.5 1 / 5
0.0.1 0 / 2

v0.1.8

2 findings
HIGH Package has 'install' script install-scripts

Script: node src/build.js

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.1.5

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.