← Home

@libp2p/gossipsub

npm Repository Homepage
30
Versions
—
License
No
Install Scripts
Verified
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures gitHead linked

Maintainers

daviddiasalanshawachingbrainvascosantosnpm-service-account-libp2pjacobheun

Keywords

libp2ppubsubgossip

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
provenance publisher-changed AI (provenance): achingbrain (Alex Potsides) is a listed contributor and long-standing libp2p ecosystem maintainer with 1248 approved packages; transition from service account is legitimate. ai
publish-pattern new-deps-added AI (publish-pattern): @libp2p/utils is a first-party libp2p ecosystem package replacing @libp2p/pubsub; not a suspicious third-party dependency. ai
provenance slsa-provenance AI (provenance): Package consistently published via CI/CD with SLSA provenance attestation from the official libp2p monorepo; this is a stable positive signal for all versions. ai

Versions (showing 30 of 30)

Version Deps Published
16.1.0 14 / 21
16.0.5 14 / 21
16.0.4 14 / 21
16.0.3 14 / 21
16.0.2 14 / 21
16.0.1 14 / 22
16.0.0 14 / 21
15.0.23 14 / 21
15.0.22 14 / 21
15.0.21 14 / 21
15.0.20 14 / 21
15.0.19 14 / 21
15.0.17 14 / 21
15.0.16 14 / 21
15.0.15 14 / 21
15.0.14 14 / 21
15.0.13 14 / 21
15.0.12 14 / 21
15.0.11 14 / 22
15.0.10 14 / 22
15.0.9 14 / 22
15.0.8 14 / 22
15.0.7 14 / 22
15.0.6 14 / 22
15.0.5 14 / 22
15.0.4 14 / 22
15.0.3 14 / 22
15.0.2 14 / 22
15.0.1 14 / 22
15.0.0 14 / 22

v16.1.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v16.0.5

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v16.0.4

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.