← Home

@libp2p/webrtc

npm Repository Homepage
28
Versions
—
License
No
Install Scripts
Verified
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures gitHead linked

Maintainers

daviddiasalanshawachingbrainvascosantosnpm-service-account-libp2pjacobheun

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
dependencies unvetted-dep:@libp2p/noise AI (dependencies): @libp2p/noise is a core libp2p ecosystem package; stable false positive for this package. ai
provenance publisher-changed AI (provenance): achingbrain is the primary js-libp2p maintainer (1270 approved, 0 rejected, 2096 days history). Change from service account to maintainer account is a normal operational transition, not a takeover. ai
dependencies unvetted-dep:node-datachannel AI (dependencies): node-datachannel is the standard native WebRTC data channel library for Node.js; its use is expected and appropriate for a WebRTC transport package. ai
dependencies unvetted-dep:it-protobuf-stream AI (dependencies): it-protobuf-stream is a libp2p ecosystem utility; its use is expected in libp2p transport packages for protobuf-based signaling. ai
dependencies unvetted-dep:react-native-webrtc AI (dependencies): react-native-webrtc is used for React Native platform support, explicitly mapped in package.json's react-native field. Appropriate for a cross-platform WebRTC transport. ai

Versions (showing 28 of 28)

Version Deps Published
6.0.28 33 / 11
6.0.27 33 / 11
6.0.26 33 / 11
6.0.25 33 / 11
6.0.24 33 / 11
6.0.23 33 / 11
6.0.22 33 / 11
6.0.21 33 / 11
6.0.20 33 / 11
6.0.19 33 / 11
6.0.18 34 / 11
6.0.16 33 / 11
6.0.15 33 / 11
6.0.14 33 / 11
6.0.13 33 / 11
6.0.12 33 / 11
6.0.11 33 / 11
6.0.10 33 / 11
6.0.9 33 / 11
6.0.8 33 / 11
6.0.7 33 / 11
6.0.6 33 / 11
6.0.5 33 / 11
6.0.4 33 / 11
6.0.3 33 / 11
6.0.2 33 / 11
6.0.1 33 / 11
6.0.0 33 / 11

v6.0.28

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v6.0.27

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v6.0.26

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.