@canboat/canboatjs
Supply chain provenance
Status for the latest visible version.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| semgrep | semgrep:base64-decode | AI (semgrep): Base64 decoding is part of NMEA2000/PGN protocol parsing, not obfuscation. | ai | |
| phantom-deps | phantom-dep:minimist | AI (phantom-deps): minimist is a declared runtime dependency in package.json; phantom-dep is a false positive. | ai | |
| semgrep | semgrep:hex-decode | AI (semgrep): Hex decoding appears in test files for binary protocol test vectors; not malicious. | ai | |
| provenance | publisher-changed | AI (provenance): Transition to GitHub Actions publishing is attested via SLSA provenance; legitimate CI/CD migration for this established package. | ai | |
| publish-pattern | dormant-publish | AI (publish-pattern): SLSA provenance attestation confirms legitimate publish; dormancy explained by CI/CD migration. | ai | |
| phantom-deps | phantom-dep:split | AI (phantom-deps): Used in config/runtime contexts; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:dnssd | AI (phantom-deps): Used in config/runtime contexts; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:node-addon-api | AI (phantom-deps): node-addon-api is a build-time native addon dependency, not imported directly in JS — stable false positive. | ai | |
| install-scripts | install-script:install | AI (install-scripts): node-gyp rebuild with graceful fallback; consistent with gypfile:true and native CAN socket addon purpose. | ai |
Versions (showing 47 of 47)
| Version | Deps | Published |
|---|---|---|
| 3.19.0 | 11 / 27 | |
| 3.16.4 | 11 / 27 | |
| 3.16.3 | 11 / 27 | |
| 3.15.1 | 10 / 27 | |
| 3.15.0 | 10 / 27 | |
| 3.14.0 | 10 / 27 | |
| 3.13.2 | 10 / 27 | |
| 3.13.0 | 10 / 27 | |
| 3.12.2 | 10 / 27 | |
| 3.12.1 | 10 / 27 | |
| 3.12.0 | 10 / 27 | |
| 3.11.1 | 10 / 27 | |
| 3.11.0 | 10 / 28 | |
| 3.10.4 | 10 / 28 | |
| 3.10.3 | 10 / 28 | |
| 3.10.2 | 10 / 28 | |
| 3.10.1 | 10 / 28 | |
| 3.10.0 | 10 / 28 | |
| 3.9.2 | 10 / 28 | |
| 3.9.1 | 10 / 28 | |
| 3.9.0 | 10 / 28 | |
| 3.8.5 | 10 / 28 | |
| 3.8.4 | 10 / 28 | |
| 3.8.3 | 10 / 28 | |
| 3.8.2 | 10 / 28 | |
| 3.8.1 | 10 / 28 | |
| 3.8.0 | 10 / 28 | |
| 3.7.0 | 10 / 28 | |
| 3.6.0 | 10 / 28 | |
| 3.5.3 | 10 / 28 | |
| 3.5.2 | 10 / 28 | |
| 3.5.1 | 10 / 28 | |
| 3.5.0 | 10 / 27 | |
| 3.4.2 | 10 / 27 | |
| 3.4.1 | 10 / 27 | |
| 3.4.0 | 10 / 27 | |
| 3.3.5 | 10 / 27 | |
| 3.3.4 | 10 / 27 | |
| 3.3.3 | 10 / 27 | |
| 3.3.2 | 10 / 27 | |
| 3.3.1 | 10 / 27 | |
| 3.3.0 | 10 / 27 | |
| 3.2.4 | 10 / 27 | |
| 3.2.3 | 10 / 27 | |
| 3.2.2 | 10 / 27 | |
| 3.1.0 | 10 / 27 | |
| 3.0.0 | 10 / 11 |
v3.19.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v3.16.4
2 findingsScript: node-gyp rebuild || echo 'Native CAN socket addon not available on this platform'
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v3.16.3
2 findingsScript: node-gyp rebuild || echo 'Native CAN socket addon not available on this platform'
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v3.15.1
2 findingsThis version was published by a different npm account than previous versions on 2026-03-20. This could indicate a legitimate maintainer transition or an account compromise.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v3.15.0
2 findingsThis version was published by a different npm account than previous versions on 2026-03-13. This could indicate a legitimate maintainer transition or an account compromise.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v3.14.0
2 findingsThis version was published by a different npm account than previous versions on 2026-03-06. This could indicate a legitimate maintainer transition or an account compromise.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v3.13.2
2 findingsThis version was published by a different npm account than previous versions on 2026-01-23. This could indicate a legitimate maintainer transition or an account compromise.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v3.13.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.12.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v3.12.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.12.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.11.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.11.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.10.4
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.10.3
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.10.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.10.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.10.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.9.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.9.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.9.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.8.5
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.8.4
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.8.3
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.8.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.8.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.8.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.7.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.6.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.5.3
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.5.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.5.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.5.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.4.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.4.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.4.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.3.5
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.3.4
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v3.3.3
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v3.3.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v3.3.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v3.3.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v3.2.4
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v3.2.3
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v3.2.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v3.1.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v3.0.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.