thread-sleep-compat MIT 14 versions

thread-sleep-compat

npm Repository Homepage

thread-sleep the runs on multiple versions of node

14

Versions

MIT

License

No

Install Scripts

Missing

Provenance

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.

Maintainers

kmalakoff

Keywords

thread-sleepthreadsleep

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
npm-metadata	bundled-binaries	AI (npm-metadata): Prebuilt .node binaries for multi-platform/Node-version compatibility are the core purpose of this package.	ai	2026/05/30
phantom-deps	phantom-dep:nan	AI (phantom-deps): nan is a native addon build dependency referenced in build config, not directly imported in JS.	ai	2026/05/30
publish-pattern	dormant-publish	AI (publish-pattern): Trusted publisher with 403 approved packages; sporadic release cadence is normal for this utility.	ai	2026/05/29
install-scripts	install-script:postinstall	AI (install-scripts): Native binding prebuilt-binary download; standard pattern for this publisher's packages.	ai	2026/05/26
semgrep	semgrep:child-process-import	AI (semgrep): child_process used in postinstall to spawn build/download for native addon.	ai	2026/05/26
semgrep	semgrep:dynamic-require	AI (semgrep): Dynamic require loads package.json and platform-specific binaries; standard native addon pattern.	ai	2026/05/26

Versions (showing 14 of 14)

Version	Deps	Published
1.3.2	5 / 11	2026-05-26
1.3.1	5 / 11	2025-12-18
1.2.0	3 / 11	2025-12-18
1.1.2	3 / 11	2025-12-12
1.1.0	6 / 10	2025-12-11
1.0.8	4 / 13	2025-12-04
1.0.7	4 / 13	2025-12-04
1.0.6	4 / 13	2025-12-02
1.0.5	4 / 10	2025-11-06
1.0.4	4 / 10	2025-10-21
1.0.3	4 / 10	2025-10-21
1.0.2	4 / 10	2025-07-08
1.0.1	4 / 10	2025-06-21
1.0.0	4 / 10	2025-06-21

v1.3.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.3.1

2 findings

HIGH Package has 'postinstall' script install-scripts

Script: node assets/postinstall.cjs

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.2.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.1.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.1.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.0.8

2 findings

HIGH Bundled binary files (39) npm-metadata

Package contains compiled binaries that could be backdoors: • out/thread-sleep-compat-node-v0x000B-darwin-arm64/build/Release/thread_sleep.node • out/thread-sleep-compat-node-v0x000B-darwin-x64/build/Release/thread_sleep.node • out/thread-sleep-compat-node-v0x000B-linux-arm64/build/Release/thread_sleep.node • out/thread-sleep-compat-node-v0x000B-linux-armv6l/build/Release/thread_sleep.node • out/thread-sleep-compat-node-v0x000B-linux-armv7l/build/Release/thread_sleep.node • out/thread-sleep-compat-node-v0x000B-linux-ppc64/build/Release/thread_sleep.node • out/thread-sleep-compat-node-v0x000B-linux-ppc64le/build/Release/thread_sleep.node • out/thread-sleep-compat-node-v0x000B-linux-s390x/build/Release/thread_sleep.node • out/thread-sleep-compat-node-v0x000B-linux-x64/build/Release/thread_sleep.node • out/thread-sleep-compat-node-v0x000B-linux-x86/build/Release/thread_sleep.node ... and 29 more

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.0.7

2 findings

HIGH Bundled binary files (39) npm-metadata

Package contains compiled binaries that could be backdoors: • out/thread-sleep-compat-node-v0x000B-darwin-arm64/build/Release/thread_sleep.node • out/thread-sleep-compat-node-v0x000B-darwin-x64/build/Release/thread_sleep.node • out/thread-sleep-compat-node-v0x000B-linux-arm64/build/Release/thread_sleep.node • out/thread-sleep-compat-node-v0x000B-linux-armv6l/build/Release/thread_sleep.node • out/thread-sleep-compat-node-v0x000B-linux-armv7l/build/Release/thread_sleep.node • out/thread-sleep-compat-node-v0x000B-linux-ppc64/build/Release/thread_sleep.node • out/thread-sleep-compat-node-v0x000B-linux-ppc64le/build/Release/thread_sleep.node • out/thread-sleep-compat-node-v0x000B-linux-s390x/build/Release/thread_sleep.node • out/thread-sleep-compat-node-v0x000B-linux-x64/build/Release/thread_sleep.node • out/thread-sleep-compat-node-v0x000B-linux-x86/build/Release/thread_sleep.node ... and 29 more

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.0.6

2 findings

HIGH Bundled binary files (39) npm-metadata

Package contains compiled binaries that could be backdoors: • out/thread-sleep-compat-node-v0x000B-darwin-arm64/build/Release/thread_sleep.node • out/thread-sleep-compat-node-v0x000B-darwin-x64/build/Release/thread_sleep.node • out/thread-sleep-compat-node-v0x000B-linux-arm64/build/Release/thread_sleep.node • out/thread-sleep-compat-node-v0x000B-linux-armv6l/build/Release/thread_sleep.node • out/thread-sleep-compat-node-v0x000B-linux-armv7l/build/Release/thread_sleep.node • out/thread-sleep-compat-node-v0x000B-linux-ppc64/build/Release/thread_sleep.node • out/thread-sleep-compat-node-v0x000B-linux-ppc64le/build/Release/thread_sleep.node • out/thread-sleep-compat-node-v0x000B-linux-s390x/build/Release/thread_sleep.node • out/thread-sleep-compat-node-v0x000B-linux-x64/build/Release/thread_sleep.node • out/thread-sleep-compat-node-v0x000B-linux-x86/build/Release/thread_sleep.node ... and 29 more

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.0.5

2 findings

HIGH Bundled binary files (39) npm-metadata

Package contains compiled binaries that could be backdoors: • out/thread-sleep-compat-node-v0x000B-darwin-arm64/build/Release/thread_sleep.node • out/thread-sleep-compat-node-v0x000B-darwin-x64/build/Release/thread_sleep.node • out/thread-sleep-compat-node-v0x000B-linux-arm64/build/Release/thread_sleep.node • out/thread-sleep-compat-node-v0x000B-linux-armv6l/build/Release/thread_sleep.node • out/thread-sleep-compat-node-v0x000B-linux-armv7l/build/Release/thread_sleep.node • out/thread-sleep-compat-node-v0x000B-linux-ppc64/build/Release/thread_sleep.node • out/thread-sleep-compat-node-v0x000B-linux-ppc64le/build/Release/thread_sleep.node • out/thread-sleep-compat-node-v0x000B-linux-s390x/build/Release/thread_sleep.node • out/thread-sleep-compat-node-v0x000B-linux-x64/build/Release/thread_sleep.node • out/thread-sleep-compat-node-v0x000B-linux-x86/build/Release/thread_sleep.node ... and 29 more

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.0.4

2 findings

HIGH Bundled binary files (39) npm-metadata

Package contains compiled binaries that could be backdoors: • out/thread-sleep-compat-node-v0x000B-darwin-arm64/build/Release/thread_sleep.node • out/thread-sleep-compat-node-v0x000B-darwin-x64/build/Release/thread_sleep.node • out/thread-sleep-compat-node-v0x000B-linux-arm64/build/Release/thread_sleep.node • out/thread-sleep-compat-node-v0x000B-linux-armv6l/build/Release/thread_sleep.node • out/thread-sleep-compat-node-v0x000B-linux-armv7l/build/Release/thread_sleep.node • out/thread-sleep-compat-node-v0x000B-linux-ppc64/build/Release/thread_sleep.node • out/thread-sleep-compat-node-v0x000B-linux-ppc64le/build/Release/thread_sleep.node • out/thread-sleep-compat-node-v0x000B-linux-s390x/build/Release/thread_sleep.node • out/thread-sleep-compat-node-v0x000B-linux-x64/build/Release/thread_sleep.node • out/thread-sleep-compat-node-v0x000B-linux-x86/build/Release/thread_sleep.node ... and 29 more

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.0.3

2 findings

HIGH Bundled binary files (39) npm-metadata

Package contains compiled binaries that could be backdoors: • out/thread-sleep-compat-node-v0x000B-darwin-arm64/build/Release/thread_sleep.node • out/thread-sleep-compat-node-v0x000B-darwin-x64/build/Release/thread_sleep.node • out/thread-sleep-compat-node-v0x000B-linux-arm64/build/Release/thread_sleep.node • out/thread-sleep-compat-node-v0x000B-linux-armv6l/build/Release/thread_sleep.node • out/thread-sleep-compat-node-v0x000B-linux-armv7l/build/Release/thread_sleep.node • out/thread-sleep-compat-node-v0x000B-linux-ppc64/build/Release/thread_sleep.node • out/thread-sleep-compat-node-v0x000B-linux-ppc64le/build/Release/thread_sleep.node • out/thread-sleep-compat-node-v0x000B-linux-s390x/build/Release/thread_sleep.node • out/thread-sleep-compat-node-v0x000B-linux-x64/build/Release/thread_sleep.node • out/thread-sleep-compat-node-v0x000B-linux-x86/build/Release/thread_sleep.node ... and 29 more

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.0.2

2 findings

HIGH Bundled binary files (39) npm-metadata

Package contains compiled binaries that could be backdoors: • out/thread-sleep-compat-node-v0x000B-darwin-arm64/build/Release/thread_sleep.node • out/thread-sleep-compat-node-v0x000B-darwin-x64/build/Release/thread_sleep.node • out/thread-sleep-compat-node-v0x000B-linux-arm64/build/Release/thread_sleep.node • out/thread-sleep-compat-node-v0x000B-linux-armv6l/build/Release/thread_sleep.node • out/thread-sleep-compat-node-v0x000B-linux-armv7l/build/Release/thread_sleep.node • out/thread-sleep-compat-node-v0x000B-linux-ppc64/build/Release/thread_sleep.node • out/thread-sleep-compat-node-v0x000B-linux-ppc64le/build/Release/thread_sleep.node • out/thread-sleep-compat-node-v0x000B-linux-s390x/build/Release/thread_sleep.node • out/thread-sleep-compat-node-v0x000B-linux-x64/build/Release/thread_sleep.node • out/thread-sleep-compat-node-v0x000B-linux-x86/build/Release/thread_sleep.node ... and 29 more

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.0.1

2 findings

HIGH Bundled binary files (39) npm-metadata

Package contains compiled binaries that could be backdoors: • out/thread-sleep-compat-node-v0x000B-darwin-arm64/build/Release/thread_sleep.node • out/thread-sleep-compat-node-v0x000B-darwin-x64/build/Release/thread_sleep.node • out/thread-sleep-compat-node-v0x000B-linux-arm64/build/Release/thread_sleep.node • out/thread-sleep-compat-node-v0x000B-linux-armv6l/build/Release/thread_sleep.node • out/thread-sleep-compat-node-v0x000B-linux-armv7l/build/Release/thread_sleep.node • out/thread-sleep-compat-node-v0x000B-linux-ppc64/build/Release/thread_sleep.node • out/thread-sleep-compat-node-v0x000B-linux-ppc64le/build/Release/thread_sleep.node • out/thread-sleep-compat-node-v0x000B-linux-s390x/build/Release/thread_sleep.node • out/thread-sleep-compat-node-v0x000B-linux-x64/build/Release/thread_sleep.node • out/thread-sleep-compat-node-v0x000B-linux-x86/build/Release/thread_sleep.node ... and 29 more

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.0.0

2 findings

HIGH Bundled binary files (39) npm-metadata

Package contains compiled binaries that could be backdoors: • out/thread-sleep-compat-node-v0x000B-darwin-arm64/build/Release/thread_sleep.node • out/thread-sleep-compat-node-v0x000B-darwin-x64/build/Release/thread_sleep.node • out/thread-sleep-compat-node-v0x000B-linux-arm64/build/Release/thread_sleep.node • out/thread-sleep-compat-node-v0x000B-linux-armv6l/build/Release/thread_sleep.node • out/thread-sleep-compat-node-v0x000B-linux-armv7l/build/Release/thread_sleep.node • out/thread-sleep-compat-node-v0x000B-linux-ppc64/build/Release/thread_sleep.node • out/thread-sleep-compat-node-v0x000B-linux-ppc64le/build/Release/thread_sleep.node • out/thread-sleep-compat-node-v0x000B-linux-s390x/build/Release/thread_sleep.node • out/thread-sleep-compat-node-v0x000B-linux-x64/build/Release/thread_sleep.node • out/thread-sleep-compat-node-v0x000B-linux-x86/build/Release/thread_sleep.node ... and 29 more

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.