← Home

@libp2p/tls

npm Repository Homepage
25
Versions
—
License
No
Install Scripts
Verified
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures gitHead linked

Maintainers

daviddiasalanshawachingbrainvascosantosnpm-service-account-libp2pjacobheun

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
provenance publisher-changed AI (provenance): Transition from npm-service-account-libp2p to achingbrain is a legitimate org change; achingbrain is the primary js-libp2p maintainer with a strong track record and SLSA provenance attestation. ai
publish-pattern dormant-publish AI (publish-pattern): Sub-package of js-libp2p monorepo; dormancy is expected for stable components. SLSA provenance and no material code changes confirm legitimacy. ai
provenance slsa-provenance AI (provenance): Package explicitly enables provenance in publishConfig; SLSA attestation via Sigstore is a stable, expected signal for this package going forward. ai
publish-pattern new-deps-added AI (publish-pattern): reflect-metadata is a well-known package required by @peculiar/asn1-schema decorators already in the dep tree; addition is consistent with existing dependencies. ai
typosquat typosquat.levenshtein:qs AI (typosquat): Scoped package @libp2p/tls is part of the official js-libp2p monorepo; Levenshtein comparison to 'qs' is a false positive with no plausible impersonation intent. ai

Versions (showing 25 of 25)

Version Deps Published
3.1.7 14 / 5
3.1.6 14 / 5
3.1.5 14 / 5
3.1.4 14 / 5
3.1.3 14 / 5
3.1.2 14 / 5
3.1.1 14 / 5
3.1.0 14 / 5
3.0.17 14 / 5
3.0.15 13 / 5
3.0.14 13 / 5
3.0.13 13 / 5
3.0.12 13 / 5
3.0.11 13 / 5
3.0.10 13 / 5
3.0.9 13 / 5
3.0.8 13 / 5
3.0.7 13 / 5
3.0.6 13 / 5
3.0.5 13 / 5
3.0.4 13 / 5
3.0.3 13 / 5
3.0.2 13 / 5
3.0.1 13 / 5
3.0.0 13 / 5

v3.1.7

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v3.1.6

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v3.1.5

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.