xcode
parser for xcodeproj/project.pbxproj files
1
Versions
Apache-2.0
License
No
Install Scripts
Missing
Provenance
Supply chain provenance
Status for the latest visible version.
No SLSA provenance
npm registry signatures
No source commit
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
alunnyanisbowserjbrodybitscordovaownerdpogueerisufilmajjanpioniklasmerzpurplecabbageshazronshephebstevegillsujan12surajpindoria
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| semgrep | semgrep:child-process-import | AI (semgrep): child_process.fork is used legitimately in this Apache Cordova build tool for Xcode project file manipulation; not indicative of malicious behavior. | ai | |
| dependencies | unvetted-dep:simple-plist | AI (dependencies): simple-plist is a functional dependency for parsing plist-format Xcode project files; its use is appropriate and expected for this package. | ai |
Versions (showing 1 of 1)
| Version | Deps | Published |
|---|---|---|
| 3.0.1 | 2 / 3 |