@gjsify/tls
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| phantom-deps | phantom-dep:@girs/glib-2.0 | AI (phantom-deps): Referenced via config, not direct import; benign typings dep. | ai | |
| dependencies | unvetted-dep:@girs/glib-2.0 | AI (dependencies): Standard @girs GObject-introspection typings dep for gjs. | ai | |
| dependencies | unvetted-dep:@girs/gio-2.0 | AI (dependencies): Standard @girs GObject-introspection typings dep for gjs. | ai | |
| provenance | publisher-changed | AI (provenance): CI-based publish (GitHub Actions) with unchanged provenance direction; not a takeover signal. | ai | |
| phantom-deps | phantom-dep:@gjsify/utils | AI (phantom-deps): Same-org scope, used transitively in bundled output. | ai | |
| source-diff | obfuscated-file:lib/esm/tls-server.js | AI (source-diff): Bundled/minified build output (rolldown), not true obfuscation; matches stated TLS functionality. | ai | |
| dependencies | unvetted-dep:@gjsify/tls-native | AI (dependencies): Same-org monorepo sibling package, version-locked to this package. | ai | |
| phantom-deps | phantom-dep:@gjsify/net | AI (phantom-deps): Same-org sibling dep; may be re-exported rather than directly imported in this package. | ai | |
| typosquat | typosquat.levenshtein:qs | AI (typosquat): Scoped @gjsify package; Levenshtein match to 'qs' is coincidental, not a typosquat. | ai |
Versions (showing 8 of 8)
| Version | Deps | Published |
|---|---|---|
| 0.13.2 | 5 / 4 | |
| 0.4.43 | 5 / 4 | |
| 0.4.42 | 5 / 4 | |
| 0.4.26 | 5 / 4 | |
| 0.4.11 | 4 / 4 | |
| 0.4.10 | 4 / 4 | |
| 0.3.20 | 4 / 4 | |
| 0.1.1 | 4 / 4 |
v0.13.2
3 findingsThis version was published by a different npm account than previous versions on 2026-06-29. This could indicate a legitimate maintainer transition or an account compromise.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.4.11
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.4.10
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.