@kubernetes/client-node
NodeJS client for kubernetes
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| dependencies | unvetted-dep:jsonpath | AI (dependencies): jsonpath is a well-known, legitimate JSON querying library with no malicious signals; stable dependency for this package. | ai | |
| phantom-deps | phantom-dep:@types/websocket | AI (phantom-deps): TypeScript @types packages are framework-scoped and loaded by convention; stable false positive for this TypeScript package. | ai | |
| phantom-deps | phantom-dep:@types/bluebird | AI (phantom-deps): TypeScript @types packages are framework-scoped and loaded by convention; stable false positive for this TypeScript package. | ai | |
| phantom-deps | phantom-dep:@types/mock-fs | AI (phantom-deps): TypeScript @types packages are framework-scoped and loaded by convention; stable false positive for this TypeScript package. | ai | |
| phantom-deps | phantom-dep:@types/base-64 | AI (phantom-deps): TypeScript @types packages are framework-scoped and loaded by convention; stable false positive for this TypeScript package. | ai | |
| phantom-deps | phantom-dep:bluebird | AI (phantom-deps): bluebird is a legitimate Promise library; declared as dependency for transitive use, not a security concern for this package. | ai | |
| dependencies | unvetted-dep:@types/mock-fs | AI (dependencies): TypeScript type definition package for mock-fs; no security risk, used for testing conventions in this TypeScript package. | ai | |
| dependencies | unvetted-dep:@types/base-64 | AI (dependencies): TypeScript type definition package; no security risk, framework-scoped usage is expected for this TypeScript package. | ai | |
| source-diff | source-size-tripled | AI (source-diff): Size increase is explained by auto-generated API surface for the full Kubernetes API; consistent with the package's purpose and major version bump. | ai | |
| source-diff | large-new-source-files | AI (source-diff): Large file count is due to auto-generated Kubernetes API client code covering hundreds of resource types; expected for this package's major version release. | ai | |
| phantom-deps | phantom-dep:@types/underscore | AI (phantom-deps): TypeScript type definitions are conventionally loaded without direct imports; expected for TS projects. | ai | |
| phantom-deps | phantom-dep:@types/request | AI (phantom-deps): TypeScript type definitions; conventionally loaded without direct imports. | ai | |
| provenance | no-provenance | AI (provenance): Established package with 71 versions and 3050-day history; lack of Sigstore provenance is common and not a disqualifier here. | ai | |
| dependencies | unvetted-dep:request | AI (dependencies): request is a standard HTTP client library; its use in a Kubernetes client is expected and stable. | ai | |
| publish-pattern | dormant-publish | AI (publish-pattern): Official Kubernetes client; dormancy is normal for stable infra libraries. SLSA provenance confirms legitimate CI/CD publish. | ai | |
| publish-pattern | new-deps-added | AI (publish-pattern): Deps are well-known packages (tar, tmp-promise, @types/*); replacing tar-fs with tar is a routine maintenance change. | ai | |
| phantom-deps | phantom-dep:tslib | AI (phantom-deps): tslib is a standard TypeScript runtime utility; implicit dependency is expected and stable for this package. | ai | |
| provenance | publisher-changed | AI (provenance): Publisher changed from individual maintainer to GitHub Actions CI/CD, corroborated by SLSA provenance attestation. Standard automation migration. | ai | |
| phantom-deps | phantom-dep:@types/ws | AI (phantom-deps): TypeScript type definitions for ws; conventionally loaded without direct imports. | ai | |
| phantom-deps | phantom-dep:@types/tar | AI (phantom-deps): TypeScript type definitions; conventionally loaded without direct imports. | ai | |
| dependencies | unvetted-dep:stream-buffers | AI (dependencies): stream-buffers is a standard utility for stream handling; stable dependency for this package. | ai | |
| dependencies | unvetted-dep:jsonpath-plus | AI (dependencies): jsonpath-plus is a standard JSON query library; appropriate for Kubernetes client operations. | ai | |
| dependencies | unvetted-dep:@types/stream-buffers | AI (dependencies): TypeScript type definitions package; no runtime security risk. | ai | |
| dependencies | unvetted-dep:socks-proxy-agent | AI (dependencies): socks-proxy-agent is a legitimate SOCKS proxy library; appropriate for a Kubernetes client needing proxy support. | ai | |
| dependencies | unvetted-dep:@types/node-fetch | AI (dependencies): TypeScript type definitions package; no runtime security risk. | ai | |
| phantom-deps | phantom-dep:@types/node-fetch | AI (phantom-deps): Framework-scoped TypeScript type package; phantom-dep finding is expected and benign for TypeScript libraries. | ai | |
| dependencies | unvetted-dep:hpagent | AI (dependencies): hpagent is a legitimate HTTP proxy agent library, appropriate for a Kubernetes client needing proxy support. | ai | |
| phantom-deps | phantom-dep:@types/node | AI (phantom-deps): Node.js type definitions; standard for all Node.js TypeScript projects. | ai | |
| phantom-deps | phantom-dep:@types/js-yaml | AI (phantom-deps): TypeScript type definitions; conventionally loaded without direct imports. | ai | |
| phantom-deps | phantom-dep:@types/stream-buffers | AI (phantom-deps): TypeScript type definitions; conventionally loaded without direct imports. | ai | |
| dependencies | unvetted-dep:openid-client | AI (dependencies): openid-client is a legitimate OIDC library; appropriate for Kubernetes OIDC authentication support. | ai | |
| dependencies | unvetted-dep:isomorphic-ws | AI (dependencies): isomorphic-ws is a standard WebSocket abstraction library, appropriate for a Kubernetes client needing exec/watch support. | ai | |
| dependencies | unvetted-dep:node-fetch | AI (dependencies): node-fetch is a widely-used HTTP client library; appropriate dependency for a Kubernetes client. | ai | |
| dependencies | unvetted-dep:rfc4648 | AI (dependencies): rfc4648 is a well-known base64/base32 encoding library with no security concerns. | ai | |
| phantom-deps | phantom-dep:ws | AI (phantom-deps): WebSocket library referenced in config files; standard for Kubernetes client communication. | ai | |
| dependencies | unvetted-dep:tar-fs | AI (dependencies): tar-fs is a well-known, widely-used npm package appropriate for a Kubernetes client that handles container image operations. | ai |
Versions (showing 13 of 13)
| Version | Deps | Published |
|---|---|---|
| 1.4.0 | 16 / 15 | |
| 1.3.0 | 16 / 15 | |
| 1.2.0 | 15 / 15 | |
| 1.1.3 | 19 / 15 | |
| 1.1.2 | 19 / 15 | |
| 1.1.1 | 19 / 15 | |
| 1.1.0 | 19 / 17 | |
| 1.0.0 | 18 / 20 | |
| 0.22.2 | 10 / 26 | |
| 0.12.2 | 22 / 20 | |
| 0.10.3 | 16 / 23 | |
| 0.7.0 | 17 / 13 | |
| 0.1.1 | 11 / 12 |
v1.4.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.3.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.2.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.1.3
2 findingsPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
This version was published by a different npm account (GitHub Actions) than the most recent previously approved version (brendandburns) on 2025-12-14, but it carries Sigstore provenance attestation. This means the package moved to a trusted publisher (CI/CD with OIDC, e.g. GitHub Actions) — a supply-chain integrity improvement, not a compromise, since a stolen npm token cannot forge provenance bound to the source repository. Recorded as INFO for audit trail.
v1.1.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.1.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.1.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.12.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.