← Home

util.promisify

npm Repository Homepage

Polyfill/shim for util.promisify in node versions < v8

6
Versions
MIT
License
No
Install Scripts
Missing
Provenance

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.

Maintainers

ljharb

Keywords

promisifypromiseutilpolyfillshimutil.promisify

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
publish-pattern dormant-publish AI (publish-pattern): ljharb maintains hundreds of shim packages and updates them in batches; dormancy between releases is normal for this package and publisher. ai
dependencies unvetted-dep:define-data-property AI (dependencies): define-data-property is a well-known ljharb ecosystem package used across his entire shim portfolio; not a risk for this publisher. ai
publish-pattern new-deps-added AI (publish-pattern): All 5 new deps are standard ljharb ecosystem primitives (call-bound, define-data-property, es-errors, es-object-atoms, get-intrinsic); routine modernization, not suspicious injection. ai
phantom-deps phantom-dep:es-errors AI (phantom-deps): es-errors is a legitimate ljharb package; phantom detection likely due to indirect/config usage rather than direct import. ai

Versions (showing 6 of 6)

Version Deps Published
1.1.3 12 / 10
1.1.2 7 / 10
1.1.1 5 / 8
1.1.0 4 / 9
1.0.1 4 / 5
1.0.0 2 / 4

v1.1.3

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.1.2

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.1.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.1.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.0.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.0.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.