@discordjs/voice — Greenflagged

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures No source commit

Maintainers

crawlhydrabolt

Keywords

discorddiscord.jsaudiovoicestreaming

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
source-diff	obfuscated-file:dist/index.mjs	AI (source-diff): tsup bundler output with banner; minified not obfuscated, stable for this build tool.	ai	2026/07/19
typosquat	typosquat.levenshtein:vite	AI (typosquat): @discordjs/voice is the official Discord.js voice library in the @discordjs scope; Levenshtein similarity to 'vite' is a false positive for this scoped package.	ai	2026/04/25
phantom-deps	phantom-dep:tslib	AI (phantom-deps): tslib is a standard implicit runtime dependency for TypeScript-compiled packages; stable false positive for this package.	ai	2026/04/25
phantom-deps	phantom-dep:@types/ws	AI (phantom-deps): @types/ws is a TypeScript type declaration package used at compile time; its presence as a runtime dep declaration is a known pattern, not a phantom dep risk.	ai	2026/04/25

Versions (showing 37 of 37)

Version	Deps	Published
0.19.2	6 / 19	2026-03-17
0.19.1	6 / 19	2026-03-09
0.19.0	5 / 20	2025-08-17
0.18.0	5 / 18	2024-11-17
0.17.0	5 / 21	2024-05-04
0.16.0	5 / 19	2023-04-02
0.15.0	5 / 19	2023-03-12
0.14.0	5 / 19	2022-11-28
0.13.0	5 / 19	2022-10-08
0.11.0	5 / 17	2022-07-17
0.10.0	6 / 20	2022-06-04
0.9.0	6 / 20	2022-04-17
0.8.0	6 / 21	2022-01-24
0.7.5	6 / 25	2021-11-12
0.7.4	6 / 25	2021-11-12
0.7.3	6 / 25	2021-11-11
0.7.2	6 / 25	2021-10-30
0.7.1	6 / 25	2021-10-30
0.7.0	6 / 25	2021-10-30
0.6.0	5 / 23	2021-08-10
0.5.6	5 / 23	2021-08-07
0.5.5	5 / 23	2021-07-25
0.5.4	5 / 23	2021-07-13
0.5.3	5 / 23	2021-07-04
0.5.2	5 / 23	2021-07-03
0.5.1	5 / 22	2021-06-26
0.5.0	5 / 22	2021-06-16
0.4.0	5 / 22	2021-06-14
0.3.1	5 / 22	2021-06-11
0.3.0	5 / 22	2021-06-09
0.2.1	2 / 25	2021-06-07
0.2.0	2 / 25	2021-04-04
0.1.3	2 / 25	2021-03-31
0.1.2	2 / 21	2021-03-17
0.1.1	2 / 21	2021-03-09
0.1.0	2 / 15	2021-03-01
0.0.2	2 / 16	2021-02-15

v0.18.0

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.17.0

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.16.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.15.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.14.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.13.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.11.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.10.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.9.0

2 findings

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: hydrabolt → crawl (on 2022-04-17, known maintainer) provenance

This version was published by a different npm account (crawl) than the most recent previously approved version (hydrabolt) on 2022-04-17, but crawl is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

v0.8.0

4 findings

HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: crawl.

HIGH New obfuscated file: dist/index.mjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator. Artifact: bundled (tsup) — bundler banner in the scanned head, but the file is larger than the scan window and its remainder is unclassified, so this is not a clean bill of health.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: hydrabolt → crawl (on 2022-01-24, known maintainer) provenance

This version was published by a different npm account (crawl) than the most recent previously approved version (hydrabolt) on 2022-01-24, but crawl is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

v0.7.5

3 findings

HIGH New obfuscated file: dist/index.mjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator. Artifact: bundled (tsup) — bundler banner in the scanned head, but the file is larger than the scan window and its remainder is unclassified, so this is not a clean bill of health.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: hydrabolt → crawl (on 2021-11-12, known maintainer) provenance

This version was published by a different npm account (crawl) than the most recent previously approved version (hydrabolt) on 2021-11-12, but crawl is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

v0.7.4

3 findings

HIGH New obfuscated file: dist/index.mjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator. Artifact: bundled (tsup) — bundler banner in the scanned head, but the file is larger than the scan window and its remainder is unclassified, so this is not a clean bill of health.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: hydrabolt → crawl (on 2021-11-12, known maintainer) provenance

This version was published by a different npm account (crawl) than the most recent previously approved version (hydrabolt) on 2021-11-12, but crawl is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

v0.7.3

3 findings

HIGH New obfuscated file: dist/index.mjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator. Artifact: bundled (tsup) — bundler banner in the scanned head, but the file is larger than the scan window and its remainder is unclassified, so this is not a clean bill of health.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: hydrabolt → crawl (on 2021-11-11, known maintainer) provenance

This version was published by a different npm account (crawl) than the most recent previously approved version (hydrabolt) on 2021-11-11, but crawl is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

v0.7.2

3 findings

HIGH New obfuscated file: dist/index.mjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator. Artifact: bundled (tsup) — bundler banner in the scanned head, but the file is larger than the scan window and its remainder is unclassified, so this is not a clean bill of health.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: hydrabolt → crawl (on 2021-10-30, known maintainer) provenance

This version was published by a different npm account (crawl) than the most recent previously approved version (hydrabolt) on 2021-10-30, but crawl is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

v0.7.1

3 findings

HIGH New obfuscated file: dist/index.mjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator. Artifact: bundled (tsup) — bundler banner in the scanned head, but the file is larger than the scan window and its remainder is unclassified, so this is not a clean bill of health.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: hydrabolt → crawl (on 2021-10-30, known maintainer) provenance

This version was published by a different npm account (crawl) than the most recent previously approved version (hydrabolt) on 2021-10-30, but crawl is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

v0.7.0

3 findings

HIGH New obfuscated file: dist/index.mjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator. Artifact: bundled (tsup) — bundler banner in the scanned head, but the file is larger than the scan window and its remainder is unclassified, so this is not a clean bill of health.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: hydrabolt → crawl (on 2021-10-30, known maintainer) provenance

This version was published by a different npm account (crawl) than the most recent previously approved version (hydrabolt) on 2021-10-30, but crawl is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

v0.6.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.5.6

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.5.5

2 findings

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: crawl → hydrabolt (on 2021-07-25, known maintainer) provenance

This version was published by a different npm account (hydrabolt) than the most recent previously approved version (crawl) on 2021-07-25, but hydrabolt is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

v0.5.4

2 findings

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: crawl → hydrabolt (on 2021-07-13, known maintainer) provenance

This version was published by a different npm account (hydrabolt) than the most recent previously approved version (crawl) on 2021-07-13, but hydrabolt is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

v0.5.3

2 findings

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: hydrabolt → crawl (on 2021-07-04, known maintainer) provenance

This version was published by a different npm account (crawl) than the most recent previously approved version (hydrabolt) on 2021-07-04, but crawl is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

v0.5.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.5.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.5.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.4.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.3.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.3.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.2.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.2.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.1.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.1.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.1.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.1.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.