← Home

@graphql-mesh/transport-rest

npm Repository Homepage
4
Versions
—
License
No
Install Scripts
Verified
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures gitHead linked

Maintainers

urigodotansimhaardatanenisdenjotheguild-bot

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
semgrep semgrep:env-spread AI (semgrep): Spreads tracing info into internal fetch call, not process.env exfil to external host. ai
provenance publisher-changed AI (provenance): Transition to GitHub Actions CI publisher is confirmed by SLSA provenance attestation; stable pattern for this monorepo. ai
provenance slsa-provenance AI (provenance): Package consistently published via CI/CD with Sigstore attestation. ai
npm-metadata no-description AI (npm-metadata): Monorepo sub-package; missing description is a known pattern across the @graphql-mesh namespace, not a malware indicator. ai

Versions (showing 4 of 104)

Version Deps Published
0.2.7 6 / 0
0.2.6 6 / 0
0.2.5 6 / 0
0.2.4 6 / 0

v0.2.7

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.2.6

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.2.5

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.2.4

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.