← Home

weak-napi

npm Repository Homepage

Make weak references to JavaScript Objects.

4
Versions
MIT
License
Yes
Install Scripts
Missing
Provenance

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.

Maintainers

addaleax

Keywords

weakreferencejsjavascriptobjectfunctioncallbacknapi

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
publish-pattern new-deps-added AI (publish-pattern): setimmediate-napi is a contextually appropriate NAPI dependency for this native addon package, added by a highly trusted publisher with no rejection history. ai
npm-metadata url-dep:node-addon-api AI (npm-metadata): Points to a specific commit hash in the official nodejs/node-addon-api repo — pinned commit is more secure than semver; stable pattern for this package. ai
dependencies unvetted-dep:node-gyp-build AI (dependencies): node-gyp-build is a well-known, widely-used tool for native addon prebuilt binary selection; not a risk for this package. ai
install-scripts install-script:install AI (install-scripts): node-gyp-build is the standard install script for N-API native addons shipping prebuilts; stable and expected for this package. ai
phantom-deps phantom-dep:setimmediate-napi AI (phantom-deps): setimmediate-napi is a native dependency used at the C++ level, not directly imported in JS; expected pattern for this addon. ai
npm-metadata bundled-binaries AI (npm-metadata): Prebuilt .node binaries are the intended distribution mechanism for this N-API addon, built via prebuildify by a highly trusted publisher. ai
phantom-deps phantom-dep:node-addon-api AI (phantom-deps): node-addon-api is a build-time/compile-time dependency for N-API addons; referenced in binding.gyp, not directly imported in JS. ai

Versions (showing 4 of 4)

Version Deps Published
2.0.1 3 / 4
2.0.0 3 / 4
1.0.1 3 / 2
1.0.0 2 / 2

v2.0.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.0.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.0.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.0.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.