← Home

spawn-promise

npm Repository Homepage

Spawns a process and makes it simple to pipe data in and get data out.

11
Versions
MIT
License
No
Install Scripts
Missing
Provenance

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.

Maintainers

panosoft

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
npm-metadata suspicious-initial-version AI (npm-metadata): Package is 10+ years old with 11 versions; 0.0.0 reflects early release convention, not malicious intent. Stable judgment for this package. ai
npm-metadata no-description AI (npm-metadata): Decade-old utility package; missing description is a style issue, not a security signal for this package. ai
semgrep semgrep:child-process-import AI (semgrep): spawn-promise is a child_process.spawn wrapper by design; this import is the package's core functionality, not a risk. ai
semgrep semgrep:child-process-spawn AI (semgrep): spawn-promise wraps child_process.spawn as its primary API; this finding is expected and stable across all versions. ai

Versions (showing 11 of 11)

Version Deps Published
0.1.8 1 / 3
0.1.7 1 / 3
0.1.6 1 / 3
0.1.5 1 / 3
0.1.4 1 / 3
0.1.3 1 / 3
0.1.2 1 / 3
0.1.1 1 / 3
0.1.0 1 / 3
0.0.1 1 / 3
0.0.0 1 / 2

v0.1.8

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.1.7

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.1.6

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.1.5

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.1.4

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.1.3

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.1.2

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.1.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.1.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.0.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.