← Home

@libp2p/websockets

npm Repository Homepage
26
Versions
—
License
No
Install Scripts
Verified
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures gitHead linked

Maintainers

daviddiasalanshawachingbrainvascosantosnpm-service-account-libp2pjacobheun

Keywords

IPFS

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
provenance publisher-changed AI (provenance): Migration to GitHub Actions CI/CD publishing with SLSA provenance attestation is a legitimate and encouraged practice; the change from achingbrain to GitHub Actions is expected for this libp2p monorepo package. ai
publish-pattern dormant-publish AI (publish-pattern): Package is part of the js-libp2p monorepo with 864 versions; apparent dormancy reflects monorepo release cadence, not abandonment. SLSA provenance confirms legitimate CI/CD publish. ai

Versions (showing 26 of 26)

Version Deps Published
10.1.18 11 / 8
10.1.17 11 / 8
10.1.16 11 / 8
10.1.15 11 / 8
10.1.14 11 / 8
10.1.13 11 / 8
10.1.12 11 / 8
10.1.11 11 / 8
10.1.10 11 / 8
10.1.8 11 / 8
10.1.7 11 / 8
10.1.6 11 / 8
10.1.5 11 / 8
10.1.4 11 / 8
10.1.3 11 / 8
10.1.2 11 / 8
10.1.1 11 / 8
10.1.0 11 / 8
10.0.7 11 / 8
10.0.6 11 / 8
10.0.5 11 / 8
10.0.4 11 / 8
10.0.3 11 / 8
10.0.2 11 / 8
10.0.1 13 / 7
10.0.0 13 / 7

v10.1.18

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v10.1.17

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v10.1.16

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.