← Home

@copilotkit/sdk-js

npm Repository Homepage

<img src="https://github.com/user-attachments/assets/0a6b64d9-e193-4940-a3f6-60334ac34084" alt="banner" style="border-radius: 12px; border: 2px solid #d6d4fa;" />

51
Versions
MIT
License
No
Install Scripts
Verified
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures No source commit

Maintainers

copilotkit

Keywords

aiassistantautomationcopilotcopilotkitjavascriptnextjsnodejsreacttextarea

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
provenance publisher-changed AI (provenance): CopilotKit migrated publishing to GitHub Actions CI/CD; SLSA provenance attestation confirms legitimate automated publishing. ai
bogus-package bogus-package AI (bogus-package): Monorepo SDK with subpath exports; empty main and link-dump README are structural, not spam indicators. ai

Versions (showing 51 of 73)

View all versions
Version Deps Published
1.63.2 3 / 14
1.63.1 3 / 14
1.63.0 3 / 14
1.62.3 3 / 14
1.62.2 3 / 14
1.62.1 3 / 14
1.62.0 3 / 14
1.61.2 3 / 14
1.61.1 2 / 14
1.61.0 2 / 14
1.60.2 2 / 14
1.60.1 2 / 14
1.60.0 2 / 14
1.59.5 2 / 14
1.59.4 2 / 14
1.59.3 2 / 14
1.59.2 2 / 14
1.59.1 2 / 14
1.59.0 2 / 14
1.58.0 2 / 14
1.57.4 2 / 14
1.57.3 2 / 14
1.57.2 2 / 14
1.57.1 2 / 14
1.57.0 2 / 14
1.56.5 2 / 14
1.56.4 2 / 14
1.56.3 2 / 14
1.56.2 2 / 14
1.56.1 2 / 14
1.56.0 2 / 14
1.55.3 2 / 14
1.55.2 2 / 14
1.55.1 2 / 14
1.55.0 2 / 14
1.54.1 2 / 15
1.54.0 1 / 15
1.53.0 1 / 15
1.52.1 1 / 15
1.52.0 1 / 15
1.51.4 1 / 17
1.51.3 1 / 17
1.51.2 1 / 17
1.51.1 0 / 18
1.51.0 0 / 18
1.50.1 1 / 15
1.50.0 1 / 15
1.10.6 1 / 16
1.10.5 1 / 16
1.10.4 1 / 16
1.10.3 1 / 16

v1.63.2

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.63.1

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.63.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.62.3

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.62.2

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.62.1

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.62.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.61.2

2 findings
HIGH Publisher changed: copilotkit → GitHub Actions (on 2026-06-25) provenance

This version was published by a different npm account than previous versions on 2026-06-25. This could indicate a legitimate maintainer transition or an account compromise.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.