serialport — Greenflagged

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.

Maintainers

reconbothipsterbrown

Keywords

ccTalkcom portCOMdata logginghardwareiotjohnny-fivemodemnodebotsRFIDroboticssensorserial portserialserialportsms gatewaysmsstreamttyUART

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
dependencies	unvetted-dep:@serialport/stream	AI (dependencies): First-party monorepo sub-package from the serialport project itself; not a third-party risk.	ai	2026/04/25
dependencies	unvetted-dep:@serialport/binding-mock	AI (dependencies): First-party monorepo sub-package from the serialport project itself; not a third-party risk.	ai	2026/04/25
dependencies	unvetted-dep:@serialport/bindings-cpp	AI (dependencies): First-party monorepo sub-package from the serialport project itself; not a third-party risk.	ai	2026/04/25
dependencies	unvetted-dep:@serialport/parser-ready	AI (dependencies): First-party monorepo sub-package from the serialport project itself; not a third-party risk.	ai	2026/04/25
dependencies	unvetted-dep:@serialport/parser-regex	AI (dependencies): First-party monorepo sub-package from the serialport project itself; not a third-party risk.	ai	2026/04/25
dependencies	unvetted-dep:@serialport/parser-cctalk	AI (dependencies): First-party monorepo sub-package from the serialport project itself; not a third-party risk.	ai	2026/04/25
dependencies	unvetted-dep:@serialport/parser-readline	AI (dependencies): First-party monorepo sub-package from the serialport project itself; not a third-party risk.	ai	2026/04/25
dependencies	unvetted-dep:@serialport/parser-delimiter	AI (dependencies): First-party monorepo sub-package from the serialport project itself; not a third-party risk.	ai	2026/04/25
dependencies	unvetted-dep:@serialport/parser-byte-length	AI (dependencies): First-party monorepo sub-package from the serialport project itself; not a third-party risk.	ai	2026/04/25
dependencies	unvetted-dep:@serialport/parser-spacepacket	AI (dependencies): First-party monorepo sub-package from the serialport project itself; not a third-party risk.	ai	2026/04/25
dependencies	unvetted-dep:@serialport/parser-slip-encoder	AI (dependencies): First-party monorepo sub-package from the serialport project itself; not a third-party risk.	ai	2026/04/25
dependencies	unvetted-dep:@serialport/parser-packet-length	AI (dependencies): First-party monorepo sub-package from the serialport project itself; not a third-party risk.	ai	2026/04/25
dependencies	unvetted-dep:@serialport/parser-inter-byte-timeout	AI (dependencies): First-party monorepo sub-package from the serialport project itself; not a third-party risk.	ai	2026/04/25
phantom-deps	phantom-dep:debug	AI (phantom-deps): debug is explicitly listed in package.json dependencies; phantom flag is a false positive likely due to indirect import patterns in the monorepo.	ai	2026/04/25
provenance	no-provenance	AI (provenance): Established package with 176 versions and trusted publisher; lack of Sigstore provenance is common and not a risk signal here.	ai	2026/04/25

Versions (showing 1 of 1)

Version	Deps	Published
13.0.0	14 / 1	2024-12-24

v13.0.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.