← Home

@libp2p/peer-store

npm Repository Homepage
25
Versions
—
License
No
Install Scripts
Verified
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures gitHead linked

Maintainers

daviddiasalanshawachingbrainvascosantosnpm-service-account-libp2pjacobheun

Keywords

IPFS

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
provenance publisher-changed AI (provenance): achingbrain is the known long-standing libp2p maintainer (1248 approved packages, 2095 days history). Transition from service account to personal account is benign, confirmed by SLSA provenance attestation. ai
dependencies unvetted-dep:mortice AI (dependencies): mortice is a legitimate, well-known mutex/locking library; its use in a peer-store for concurrency control is expected and benign. ai
dependencies unvetted-dep:@libp2p/peer-record AI (dependencies): Part of the official libp2p ecosystem; a natural dependency for peer-store functionality. ai
dependencies unvetted-dep:@libp2p/peer-collections AI (dependencies): Part of the official libp2p ecosystem; a natural dependency for peer-store functionality. ai

Versions (showing 25 of 25)

Version Deps Published
12.0.25 14 / 10
12.0.24 14 / 10
12.0.23 14 / 10
12.0.22 14 / 10
12.0.21 14 / 10
12.0.20 14 / 10
12.0.19 14 / 10
12.0.18 14 / 10
12.0.17 14 / 10
12.0.15 14 / 10
12.0.14 14 / 10
12.0.13 14 / 10
12.0.12 14 / 10
12.0.11 14 / 10
12.0.10 14 / 10
12.0.9 14 / 10
12.0.8 14 / 10
12.0.7 14 / 10
12.0.6 14 / 10
12.0.5 14 / 10
12.0.4 14 / 10
12.0.3 14 / 10
12.0.2 14 / 10
12.0.1 14 / 10
12.0.0 14 / 10

v12.0.25

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v12.0.24

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v12.0.23

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.