← Home

@helia/json

npm Repository Homepage
10
Versions
—
License
No
Install Scripts
Verified
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures gitHead linked

Maintainers

npm-service-account-ipfsachingbrain

Keywords

IPFS

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
provenance publisher-changed AI (provenance): ipfs/helia migrated to GitHub Actions CI publishing; SLSA attestation confirms legitimate CI/CD origin. ai
publish-pattern dormant-publish AI (publish-pattern): Dormancy followed by CI migration is consistent with the ipfs/helia monorepo's release cadence; SLSA provenance confirms integrity. ai
typosquat typosquat.levenshtein:jsdom AI (typosquat): @helia/json is a legitimate scoped package in the IPFS/Helia ecosystem; the Levenshtein match to 'jsdom' is a false positive with no impersonation intent. ai
typosquat typosquat.levenshtein:joi AI (typosquat): @helia/json is a legitimate scoped package in the IPFS/Helia ecosystem; the Levenshtein match to 'joi' is a false positive with no impersonation intent. ai

Versions (showing 10 of 10)

Version Deps Published
5.1.1 6 / 2
5.1.0 6 / 2
5.0.7 6 / 2
5.0.6 6 / 2
5.0.5 6 / 2
5.0.4 6 / 2
5.0.3 6 / 2
5.0.2 6 / 2
5.0.1 6 / 2
5.0.0 6 / 2

v5.0.7

2 findings
HIGH Publisher changed: npm-service-account-ipfs → GitHub Actions (on 2026-02-05) provenance

This version was published by a different npm account than previous versions on 2026-02-05. This could indicate a legitimate maintainer transition or an account compromise.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v5.0.6

2 findings
HIGH Publisher changed: npm-service-account-ipfs → GitHub Actions (on 2026-02-04) provenance

This version was published by a different npm account than previous versions on 2026-02-04. This could indicate a legitimate maintainer transition or an account compromise.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v5.0.5

2 findings
HIGH Publisher changed: npm-service-account-ipfs → GitHub Actions (on 2026-02-02) provenance

This version was published by a different npm account than previous versions on 2026-02-02. This could indicate a legitimate maintainer transition or an account compromise.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v5.0.4

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v5.0.3

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v5.0.2

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v5.0.1

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v5.0.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.