@cyclonedx/sign
Standalone TypeScript implementation of JSON Signature Format (JSF), JSON Signature Schema (JSS, X.590), and the JSON Canonicalization Scheme (JCS, RFC 8785). Single library covering CycloneDX 1.x (JSF) and 2.x (JSS). The only runtime dependency beyond No
Supply chain provenance
Status for the latest visible version.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| provenance | publisher-changed | AI (provenance): CycloneDX/OWASP project publishes via GitHub Actions with SLSA attestation; CI publisher is expected and verified. | ai | |
| semgrep | semgrep:base64-decode | AI (semgrep): Base64url decode is core functionality for a cryptographic signing library; not a malicious payload indicator. | ai |
v0.5.2
2 findingsThis version was published by a different npm account than previous versions on 2026-04-30. This could indicate a legitimate maintainer transition or an account compromise.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.5.1
2 findingsThis version was published by a different npm account than previous versions on 2026-04-30. This could indicate a legitimate maintainer transition or an account compromise.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.5.0
2 findingsThis version was published by a different npm account than previous versions on 2026-04-29. This could indicate a legitimate maintainer transition or an account compromise.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.4.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.