← Home

@esotericsoftware/spine-canvaskit

npm Repository Homepage

The official Spine Runtimes for CanvasKit for NodeJS

51
Versions
LicenseRef-LICENSE
License
No
Install Scripts
Verified
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures gitHead linked

Maintainers

badlogicnathansweetdaaaaa

Keywords

gamedevanimations2dspinegame-devruntimesskeletal

Versions (showing 51 of 80)

View all versions
Version Deps Published
4.3.12 2 / 2
4.3.11 2 / 2
4.3.7 2 / 2
4.3.6 2 / 2
4.3.5 2 / 2
4.3.4 2 / 2
4.3.3 2 / 2
4.3.2 2 / 2
4.3.1 2 / 2
4.3.0 2 / 2
4.2.119 2 / 2
4.2.118 2 / 2
4.2.117 2 / 2
4.2.116 2 / 2
4.2.115 2 / 2
4.2.114 2 / 2
4.2.113 2 / 2
4.2.112 2 / 2
4.2.111 2 / 2
4.2.110 2 / 2
4.2.109 2 / 2
4.2.108 2 / 2
4.2.107 2 / 2
4.2.106 2 / 2
4.2.105 2 / 2
4.2.104 2 / 2
4.2.103 2 / 2
4.2.102 2 / 2
4.2.101 2 / 2
4.2.100 2 / 2
4.2.99 2 / 2
4.2.98 2 / 2
4.2.97 2 / 2
4.2.96 2 / 2
4.2.95 2 / 2
4.2.94 2 / 2
4.2.93 2 / 2
4.2.92 2 / 2
4.2.91 2 / 2
4.2.90 2 / 2
4.2.89 2 / 2
4.2.88 2 / 2
4.2.87 2 / 2
4.2.86 2 / 2
4.2.85 2 / 2
4.2.84 2 / 2
4.2.83 2 / 2
4.2.82 2 / 2
4.2.81 2 / 2
4.2.80 2 / 2
4.2.79 2 / 2

v4.3.12

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v4.3.11

2 findings
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

INFO Publisher changed: daaaaa → GitHub Actions (on 2026-07-20, now via trusted publisher with provenance) provenance

This version was published by a different npm account (GitHub Actions) than the most recent previously approved version (daaaaa) on 2026-07-20, but it carries Sigstore provenance attestation. This means the package moved to a trusted publisher (CI/CD with OIDC, e.g. GitHub Actions) — a supply-chain integrity improvement, not a compromise, since a stolen npm token cannot forge provenance bound to the source repository. Recorded as INFO for audit trail.

v4.2.80

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v4.2.79

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.