← Home

@helia/json

npm Repository Homepage
15
Versions
—
License
No
Install Scripts
Verified
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures gitHead linked

Maintainers

npm-service-account-ipfsachingbrain

Keywords

IPFS

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
provenance publisher-changed AI (provenance): ipfs/helia migrated to GitHub Actions CI publishing; SLSA attestation confirms legitimate CI/CD origin. ai
publish-pattern dormant-publish AI (publish-pattern): Dormancy followed by CI migration is consistent with the ipfs/helia monorepo's release cadence; SLSA provenance confirms integrity. ai
typosquat typosquat.levenshtein:jsdom AI (typosquat): @helia/json is a legitimate scoped package in the IPFS/Helia ecosystem; the Levenshtein match to 'jsdom' is a false positive with no impersonation intent. ai
typosquat typosquat.levenshtein:joi AI (typosquat): @helia/json is a legitimate scoped package in the IPFS/Helia ecosystem; the Levenshtein match to 'joi' is a false positive with no impersonation intent. ai

Versions (showing 15 of 15)

Version Deps Published
6.0.4 6 / 2
6.0.3 6 / 2
6.0.2 6 / 2
6.0.1 6 / 2
6.0.0 6 / 2
5.1.1 6 / 2
5.1.0 6 / 2
5.0.7 6 / 2
5.0.6 6 / 2
5.0.5 6 / 2
5.0.4 6 / 2
5.0.3 6 / 2
5.0.2 6 / 2
5.0.1 6 / 2
5.0.0 6 / 2

v6.0.4

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v6.0.3

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v6.0.2

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v6.0.1

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v6.0.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.