← Home

@esotericsoftware/spine-canvaskit

npm Repository Homepage

The official Spine Runtimes for CanvasKit for NodeJS

80
Versions
LicenseRef-LICENSE
License
No
Install Scripts
Verified
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures gitHead linked

Maintainers

badlogicnathansweetdaaaaa

Keywords

gamedevanimations2dspinegame-devruntimesskeletal

Versions (showing 80 of 80)

Version Deps Published
4.3.12 2 / 2
4.3.11 2 / 2
4.3.7 2 / 2
4.3.6 2 / 2
4.3.5 2 / 2
4.3.4 2 / 2
4.3.3 2 / 2
4.3.2 2 / 2
4.3.1 2 / 2
4.3.0 2 / 2
4.2.119 2 / 2
4.2.118 2 / 2
4.2.117 2 / 2
4.2.116 2 / 2
4.2.115 2 / 2
4.2.114 2 / 2
4.2.113 2 / 2
4.2.112 2 / 2
4.2.111 2 / 2
4.2.110 2 / 2
4.2.109 2 / 2
4.2.108 2 / 2
4.2.107 2 / 2
4.2.106 2 / 2
4.2.105 2 / 2
4.2.104 2 / 2
4.2.103 2 / 2
4.2.102 2 / 2
4.2.101 2 / 2
4.2.100 2 / 2
4.2.99 2 / 2
4.2.98 2 / 2
4.2.97 2 / 2
4.2.96 2 / 2
4.2.95 2 / 2
4.2.94 2 / 2
4.2.93 2 / 2
4.2.92 2 / 2
4.2.91 2 / 2
4.2.90 2 / 2
4.2.89 2 / 2
4.2.88 2 / 2
4.2.87 2 / 2
4.2.86 2 / 2
4.2.85 2 / 2
4.2.84 2 / 2
4.2.83 2 / 2
4.2.82 2 / 2
4.2.81 2 / 2
4.2.80 2 / 2
4.2.79 2 / 2
4.2.78 2 / 2
4.2.77 2 / 2
4.2.76 2 / 2
4.2.75 2 / 2
4.2.74 2 / 2
4.2.73 2 / 2
4.2.72 2 / 2
4.2.71 2 / 2
4.2.70 2 / 2
4.2.69 2 / 2
4.2.68 2 / 2
4.2.67 2 / 2
4.2.66 2 / 2
4.2.65 2 / 2
4.2.64 2 / 2
4.2.63 2 / 2
4.2.62 2 / 2
4.2.61 2 / 2
4.2.60 2 / 2
4.2.59 2 / 2
4.2.58 2 / 2
4.2.57 2 / 2
4.2.56 2 / 2
4.2.55 2 / 2
4.2.54 2 / 2
4.2.53 2 / 2
4.2.52 2 / 2
4.2.49 2 / 2
4.2.48 2 / 2

v4.3.12

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v4.3.11

2 findings
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

INFO Publisher changed: daaaaa → GitHub Actions (on 2026-07-20, now via trusted publisher with provenance) provenance

This version was published by a different npm account (GitHub Actions) than the most recent previously approved version (daaaaa) on 2026-07-20, but it carries Sigstore provenance attestation. This means the package moved to a trusted publisher (CI/CD with OIDC, e.g. GitHub Actions) — a supply-chain integrity improvement, not a compromise, since a stolen npm token cannot forge provenance bound to the source repository. Recorded as INFO for audit trail.

v4.2.80

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v4.2.79

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v4.2.78

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v4.2.77

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v4.2.76

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v4.2.75

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v4.2.74

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v4.2.73

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v4.2.72

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v4.2.71

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v4.2.70

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v4.2.69

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v4.2.68

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v4.2.67

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v4.2.66

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v4.2.65

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v4.2.64

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v4.2.63

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v4.2.62

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v4.2.61

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v4.2.60

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v4.2.59

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v4.2.58

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v4.2.57

2 findings
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: badlogic → daaaaa (on 2024-08-07, known maintainer) provenance

This version was published by a different npm account (daaaaa) than the most recent previously approved version (badlogic) on 2024-08-07, but daaaaa is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

v4.2.56

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v4.2.55

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v4.2.54

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v4.2.53

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v4.2.52

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v4.2.49

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v4.2.48

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.