← Home

@connectrpc/connect-web

npm Repository Homepage
8
Versions
—
License
No
Install Scripts
Verified
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures gitHead linked

Maintainers

jdailey_buftstamm-buf

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
provenance publisher-changed AI (provenance): Transition from individual maintainer to GitHub Actions CI/CD; confirmed by SLSA provenance attestation. ai
maintainer-change maintainer-removed AI (maintainer-change): Org-level maintainer cleanup consistent with CI/CD migration for @connectrpc scoped packages. ai
publish-pattern dormant-publish AI (publish-pattern): 277-day gap is normal for a stable library; no suspicious content changes. ai

Versions (showing 8 of 8)

Version Deps Published
2.1.2 0 / 9
2.1.1 0 / 9
2.1.0 0 / 9
2.0.4 0 / 9
2.0.3 0 / 9
2.0.2 0 / 9
2.0.1 0 / 9
2.0.0 0 / 9

v2.0.2

2 findings
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: sayers-buf → srikrsna-buf (on 2025-02-26, known maintainer) provenance

This version was published by a different npm account (srikrsna-buf) than the most recent previously approved version (sayers-buf) on 2025-02-26, but srikrsna-buf is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

v2.0.1

2 findings
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: srikrsna-buf → sayers-buf (on 2025-01-09, known maintainer) provenance

This version was published by a different npm account (sayers-buf) than the most recent previously approved version (srikrsna-buf) on 2025-01-09, but sayers-buf is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

v2.0.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.