selenium-webdriver
The official WebDriver JavaScript bindings from the Selenium project
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| maintainer-change | maintainer-removed | AI (maintainer-change): Routine SeleniumHQ maintainer rotation; not indicative of takeover for this project. | ai | |
| maintainer-change | maintainer-added | AI (maintainer-change): pujagani is a known SeleniumHQ contributor; org-level maintainer rotation for this established project. | ai | |
| semgrep | semgrep:http-module-request | AI (semgrep): HTTP requests are core to selenium-webdriver's function — it communicates with browser drivers via HTTP (WebDriver wire protocol). Not exfiltration. | ai | |
| semgrep | semgrep:eval-usage | AI (semgrep): eval() is used in Google Closure Library's JSON parser fallback (goog/json/json.js), a well-known legitimate pattern in Closure-based projects. | ai | |
| provenance | no-provenance | AI (provenance): Package predates Sigstore provenance by many years; absence is expected for this legacy version of an established official Selenium package. | ai | |
| semgrep | semgrep:dll-injection-apis | AI (semgrep): LD_PRELOAD usage is selenium-webdriver's documented mechanism for Firefox no-focus library on Linux; stable and intentional for this package. | ai | |
| provenance | publisher-changed | AI (provenance): titusfortner (Titus Fortner) is a known Selenium core maintainer; this is a legitimate project governance transition within SeleniumHQ, not a suspicious takeover. | ai | |
| semgrep | semgrep:child-process-import | AI (semgrep): Spawning browser processes via child_process is core to WebDriver functionality; expected and stable for this package. | ai | |
| semgrep | semgrep:child-process-spawn | AI (semgrep): child_process.spawn is used to launch browser drivers — fundamental to selenium-webdriver's purpose. | ai | |
| npm-metadata | bundled-binaries | AI (npm-metadata): Bundled .so files are the Firefox no-focus libraries required for Linux browser automation; legitimate and documented for this package. | ai | |
| semgrep | semgrep:shady-links-raw-ip | AI (semgrep): 127.0.0.1 reference appears in a JSDoc comment example, not live network code; no actual raw IP requests. | ai | |
| semgrep | semgrep:dynamic-require | AI (semgrep): Dynamic require for loading atoms (./atoms/ + module) is a well-known internal pattern in selenium-webdriver for loading browser automation scripts. | ai | |
| semgrep | semgrep:base64-decode | AI (semgrep): Base64 decoding is used to handle WebDriver file downloads, which the protocol returns as base64-encoded zip content. Legitimate and documented behavior. | ai |
Versions (showing 49 of 49)
| Version | Deps | Published |
|---|---|---|
| 4.44.0 | 4 / 19 | |
| 4.43.0 | 4 / 19 | |
| 4.42.0 | 4 / 19 | |
| 4.39.0 | 4 / 19 | |
| 4.5.0 | 3 / 12 | |
| 4.1.2 | 3 / 12 | |
| 4.1.1 | 3 / 12 | |
| 3.6.0 | 4 / 6 | |
| 3.5.0 | 4 / 6 | |
| 3.4.0 | 4 / 6 | |
| 3.3.0 | 4 / 6 | |
| 3.1.0 | 4 / 6 | |
| 3.0.1 | 4 / 6 | |
| 3.0.0 | 4 / 6 | |
| 2.53.3 | 5 / 6 | |
| 2.53.2 | 5 / 6 | |
| 2.53.1 | 5 / 6 | |
| 2.52.0 | 5 / 6 | |
| 2.48.2 | 5 / 5 | |
| 2.48.1 | 5 / 5 | |
| 2.48.0 | 5 / 5 | |
| 2.47.0 | 5 / 5 | |
| 2.46.1 | 5 / 5 | |
| 2.46.0 | 5 / 5 | |
| 2.45.1 | 5 / 5 | |
| 2.45.0 | 5 / 5 | |
| 2.44.0 | 3 / 1 | |
| 2.43.5 | 3 / 1 | |
| 2.43.4 | 3 / 1 | |
| 2.42.1 | 0 / 1 | |
| 2.42.0 | 0 / 1 | |
| 2.41.0 | 0 / 1 | |
| 2.40.0 | 0 / 1 | |
| 2.39.0 | 0 / 1 | |
| 2.38.1 | 0 / 1 | |
| 2.38.0 | 0 / 1 | |
| 2.37.0 | 0 / 1 | |
| 2.35.2 | 0 / 1 | |
| 2.35.1 | 0 / 1 | |
| 2.35.0 | 0 / 1 | |
| 2.34.1 | 0 / 1 | |
| 2.34.0 | 0 / 1 | |
| 2.33.0 | 0 / 0 | |
| 2.32.1 | 0 / 0 | |
| 2.32.0 | 0 / 0 | |
| 2.31.0 | 0 / 0 | |
| 2.30.0 | 0 / 0 | |
| 2.29.1 | 0 / 0 | |
| 2.29.0 | 0 / 0 |
v4.44.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.42.0
2 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2026-04-09. This could indicate a legitimate maintainer transition or an account compromise.
v4.39.0
2 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2025-12-06. This could indicate a legitimate maintainer transition or an account compromise.
v3.4.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.3.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.1.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.53.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v2.53.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v2.53.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v2.52.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v2.48.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v2.48.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v2.48.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v2.47.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v2.46.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v2.46.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v2.45.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v2.45.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v2.44.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v2.43.5
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v2.43.4
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v2.42.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v2.42.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v2.41.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v2.40.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v2.39.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v2.38.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v2.38.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v2.37.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v2.35.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v2.35.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v2.35.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v2.34.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v2.34.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v2.33.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v2.32.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v2.32.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v2.31.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v2.30.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v2.29.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v2.29.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.