← Home

@libp2p/tcp

npm Repository Homepage
25
Versions
—
License
No
Install Scripts
Attested
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation (unverified) npm registry signatures gitHead linked

Maintainers

daviddiasalanshawachingbrainvascosantosnpm-service-account-libp2pjacobheun

Keywords

IPFSTCPlibp2pnetworkp2ppeerpeer-to-peer

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
provenance publisher-changed AI (provenance): achingbrain is the primary libp2p maintainer with 2095 days history and 1248 approved packages; transition from service account to personal account is legitimate. SLSA provenance attestation confirms CI/CD build integrity. ai
phantom-deps phantom-dep:@types/sinon AI (phantom-deps): @types/sinon is a TypeScript type definition package with no runtime behavior; misplaced in dependencies vs devDependencies but poses zero security risk. ai
typosquat typosquat.levenshtein:yup AI (typosquat): @libp2p/tcp is a scoped package in the official libp2p namespace; the levenshtein match against 'yup' is a false positive with no plausible confusion vector. ai
dependencies unvetted-dep:@libp2p/utils AI (dependencies): @libp2p/utils is a core utility package in the official libp2p ecosystem; expected dependency for this transport. ai
dependencies unvetted-dep:@multiformats/multiaddr-matcher AI (dependencies): @multiformats/multiaddr-matcher is part of the official multiformats ecosystem; expected dependency for a libp2p transport. ai

Versions (showing 25 of 25)

Version Deps Published
11.0.25 8 / 9
11.0.24 8 / 9
11.0.23 8 / 9
11.0.22 8 / 9
11.0.21 8 / 9
11.0.20 8 / 9
11.0.19 8 / 9
11.0.18 8 / 9
11.0.17 8 / 9
11.0.15 9 / 8
11.0.14 9 / 8
11.0.13 9 / 8
11.0.12 9 / 8
11.0.11 9 / 8
11.0.10 9 / 8
11.0.9 9 / 8
11.0.8 9 / 8
11.0.7 9 / 8
11.0.6 9 / 8
11.0.5 9 / 8
11.0.4 9 / 8
11.0.3 9 / 8
11.0.2 9 / 8
11.0.1 9 / 8
11.0.0 9 / 8

v11.0.25

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v11.0.24

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v11.0.23

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.