← Home

@graphql-mesh/transport-rest

npm Repository Homepage
51
Versions
—
License
No
Install Scripts
Verified
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures gitHead linked

Maintainers

urigodotansimhaardatanenisdenjotheguild-bot

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
semgrep semgrep:env-spread AI (semgrep): Spreads tracing info into internal fetch call, not process.env exfil to external host. ai
provenance publisher-changed AI (provenance): Transition to GitHub Actions CI publisher is confirmed by SLSA provenance attestation; stable pattern for this monorepo. ai
provenance slsa-provenance AI (provenance): Package consistently published via CI/CD with Sigstore attestation. ai
npm-metadata no-description AI (npm-metadata): Monorepo sub-package; missing description is a known pattern across the @graphql-mesh namespace, not a malware indicator. ai

Versions (showing 51 of 104)

View all versions
Version Deps Published
0.9.41 13 / 0
0.9.40 13 / 0
0.9.39 13 / 0
0.9.38 13 / 0
0.9.37 13 / 0
0.9.36 13 / 0
0.9.35 13 / 0
0.9.34 13 / 0
0.9.33 13 / 0
0.9.32 13 / 0
0.9.31 13 / 0
0.9.30 13 / 0
0.9.29 13 / 0
0.9.28 13 / 0
0.9.27 13 / 0
0.9.26 13 / 0
0.9.25 13 / 0
0.9.24 13 / 0
0.9.23 13 / 0
0.9.22 13 / 0
0.9.21 13 / 0
0.9.20 13 / 0
0.9.19 13 / 0
0.9.18 13 / 0
0.9.17 13 / 0
0.9.16 13 / 0
0.9.15 13 / 0
0.9.14 13 / 0
0.9.13 13 / 0
0.9.12 13 / 0
0.9.11 13 / 0
0.9.10 13 / 0
0.9.9 13 / 0
0.9.8 13 / 0
0.9.7 13 / 0
0.9.6 13 / 0
0.9.5 13 / 0
0.9.4 13 / 0
0.9.3 13 / 0
0.9.2 13 / 0
0.9.1 13 / 0
0.9.0 13 / 0
0.8.23 13 / 0
0.8.22 13 / 0
0.8.21 13 / 0
0.8.20 13 / 0
0.8.19 13 / 0
0.8.18 13 / 0
0.8.17 13 / 0
0.8.16 13 / 0
0.8.15 13 / 0

v0.9.41

2 findings
HIGH env-spread: esm/directives/httpOperation.js:249 semgrep

Entire process.env captured and flowed into a network request or child-process argv — likely credential harvesting Source: https://github.com/ardatan/graphql-mesh/blob/85fa5a8f095194bc1b1087a125eda35fb1df0ce6/esm/directives/httpOperation.js#L249 247 | const fetch = context?.fetch || globalFetch || defaultFetch; 248 | // Trick to pass `sourceName` to the `fetch` function for tracing > 249 | const response = await fetch(fullPath, requestInit, context, { 250 | ...info, 251 | sourceName,

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.9.4

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.9.3

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.9.2

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.9.1

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.9.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.8.23

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.8.22

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.8.21

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.8.20

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.8.19

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.8.18

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.8.17

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.8.16

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.8.15

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.