@libp2p/interface-pubsub
PubSub interface for libp2p
19
Versions
Apache-2.0 OR MIT
License
No
Install Scripts
Missing
Provenance
Supply chain provenance
Status for the latest visible version.
No SLSA provenance
npm registry signatures
gitHead linked
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
jacobheunnpm-service-account-libp2palanshawvascosantosachingbraindaviddias
Keywords
interfacelibp2p
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| provenance | publisher-changed | AI (provenance): Publisher changed from achingbrain to npm-service-account-libp2p as part of libp2p org's move to a shared CI service account. Repo remains official libp2p GitHub org. Track record: 246 approved / 0 rejected. | ai | |
| maintainer-change | maintainer-added | AI (maintainer-change): Addition of npm-service-account-libp2p and jacobheun reflects legitimate libp2p org maintainer transition, consistent with the official repo and publisher track record. | ai | |
| publish-pattern | new-deps-added | AI (publish-pattern): uint8arraylist is a well-known libp2p/multiformats ecosystem utility; its addition is consistent with the package's purpose and poses no supply-chain risk. | ai | |
| npm-metadata | suspicious-initial-version | AI (npm-metadata): The libp2p interfaces monorepo uses 0.0.0 as a standard initial version for interface packages; this is a known ecosystem pattern, not a malicious signal for this package. | ai | |
| provenance | no-provenance | AI (provenance): Package is ~3 years old, predating widespread provenance adoption. Published by the official libp2p service account with a clean track record. | ai |