@livekit/rtc-node
Supply chain provenance
Status for the latest visible version.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| phantom-deps | phantom-dep:@bufbuild/protobuf | AI (phantom-deps): Likely used in generated/native bindings not scanned by import heuristic. | ai | |
| maintainer-change | maintainer-added | AI (maintainer-change): Org-internal maintainer rotation for official LiveKit SDK, not a takeover pattern. | ai | |
| publish-pattern | new-deps-added | AI (publish-pattern): @livekit/mutex is first-party LiveKit package, not an unvetted third party. | ai | |
| maintainer-change | maintainer-removed | AI (maintainer-change): Paired with maintainer-added; consistent with normal team turnover at LiveKit. | ai | |
| provenance | publisher-changed | AI (provenance): Move to GitHub Actions CI/CD with SLSA attestation is a provenance improvement, not compromise. | ai | |
| source-diff | obfuscated-file:dist/proto/room_pb.cjs | AI (source-diff): tsup-bundled protobuf-es codegen. | ai | |
| source-diff | obfuscated-file:dist/proto/stats_pb.cjs | AI (source-diff): tsup-bundled protobuf-es codegen. | ai | |
| source-diff | obfuscated-file:dist/proto/video_frame_pb.cjs | AI (source-diff): tsup-bundled protobuf-es codegen. | ai | |
| source-diff | obfuscated-file:dist/proto/room_pb.d.cts | AI (source-diff): generated .d.cts declaration file. | ai | |
| source-diff | obfuscated-file:dist/proto/audio_frame_pb.cjs | AI (source-diff): tsup bundle of protobuf-es generated code, not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/proto/ffi_pb.cjs | AI (source-diff): tsup-bundled protobuf-es codegen. | ai | |
| source-diff | obfuscated-file:dist/proto/e2ee_pb.cjs | AI (source-diff): tsup-bundled protobuf-es codegen. | ai | |
| source-diff | encoded-string-file:src/proto/audio_frame_pb.ts | AI (source-diff): protobuf fileDesc base64 descriptor in TS source; benign | ai | |
| source-diff | encoded-string-file:dist/proto/audio_frame_pb.js | AI (source-diff): protobuf fileDesc base64 descriptor from bufbuild codegen; benign | ai | |
| source-diff | encoded-string-file:dist/proto/e2ee_pb.js | AI (source-diff): protobuf fileDesc base64 descriptor; benign generated code | ai | |
| source-diff | encoded-string-file:dist/proto/ffi_pb.js | AI (source-diff): protobuf fileDesc base64 descriptor; benign | ai | |
| source-diff | encoded-string-file:dist/proto/participant_pb.js | AI (source-diff): protobuf fileDesc base64 descriptor; benign | ai | |
| source-diff | encoded-string-file:dist/proto/room_pb.js | AI (source-diff): protobuf fileDesc base64 descriptor; benign | ai | |
| source-diff | encoded-string-file:dist/proto/stats_pb.js | AI (source-diff): protobuf fileDesc base64 descriptor; benign | ai | |
| source-diff | encoded-string-file:dist/proto/track_pb.js | AI (source-diff): protobuf fileDesc base64 descriptor; benign | ai | |
| source-diff | encoded-string-file:dist/proto/video_frame_pb.js | AI (source-diff): protobuf fileDesc base64 descriptor; benign | ai | |
| semgrep | semgrep:child-process-execsync | AI (semgrep): execSync('which ldd') is a documented NAPI-RS musl detection idiom; not a risk for this package. | ai | |
| semgrep | semgrep:child-process-import | AI (semgrep): NAPI-RS musl detection pattern; stable and benign for this native binding package. | ai | |
| dependencies | unvetted-dep:@livekit/rtc-ffi-bindings | AI (dependencies): First-party LiveKit FFI bindings; stable dependency pattern for this SDK package. | ai | |
| dependencies | unvetted-dep:@livekit/typed-emitter | AI (dependencies): First-party LiveKit org dependency; stable pattern across all versions of this package. | ai | |
| phantom-deps | phantom-dep:pino-pretty | AI (phantom-deps): pino-pretty is a declared runtime dep used as a pino transport; not directly imported in source but legitimately present. | ai |
Versions (showing 51 of 62)
| Version | Deps | Published |
|---|---|---|
| 0.13.31 | 6 / 7 | |
| 0.13.30 | 6 / 7 | |
| 0.13.29 | 6 / 7 | |
| 0.13.28 | 6 / 7 | |
| 0.13.27 | 6 / 7 | |
| 0.13.26 | 6 / 7 | |
| 0.13.25 | 6 / 7 | |
| 0.13.24 | 6 / 8 | |
| 0.13.23 | 6 / 6 | |
| 0.13.22 | 6 / 6 | |
| 0.13.21 | 5 / 6 | |
| 0.13.14 | 5 / 6 | |
| 0.13.13 | 5 / 6 | |
| 0.13.12 | 5 / 6 | |
| 0.13.11 | 5 / 6 | |
| 0.13.10 | 5 / 6 | |
| 0.13.9 | 5 / 6 | |
| 0.13.8 | 5 / 6 | |
| 0.13.7 | 5 / 6 | |
| 0.13.6 | 5 / 6 | |
| 0.13.5 | 5 / 6 | |
| 0.13.4 | 5 / 6 | |
| 0.13.3 | 3 / 6 | |
| 0.13.2 | 3 / 6 | |
| 0.13.1 | 3 / 6 | |
| 0.13.0 | 3 / 6 | |
| 0.12.2 | 3 / 6 | |
| 0.12.1 | 3 / 6 | |
| 0.12.0 | 3 / 6 | |
| 0.11.1 | 3 / 5 | |
| 0.11.0 | 3 / 5 | |
| 0.10.4 | 2 / 4 | |
| 0.10.3 | 2 / 4 | |
| 0.10.2 | 2 / 4 | |
| 0.10.1 | 2 / 4 | |
| 0.10.0 | 2 / 4 | |
| 0.9.2 | 2 / 4 | |
| 0.9.1 | 2 / 4 | |
| 0.9.0 | 2 / 4 | |
| 0.8.1 | 2 / 4 | |
| 0.8.0 | 2 / 4 | |
| 0.7.0 | 2 / 4 | |
| 0.6.2 | 2 / 4 | |
| 0.6.1 | 2 / 4 | |
| 0.6.0 | 2 / 4 | |
| 0.5.1 | 2 / 4 | |
| 0.5.0 | 2 / 4 | |
| 0.4.4 | 2 / 4 | |
| 0.4.3 | 2 / 4 | |
| 0.4.2 | 2 / 4 | |
| 0.4.1 | 2 / 4 |
v0.13.31
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.13.30
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.13.24
2 findingsThis version was published by a different npm account than previous versions on 2026-01-15. This could indicate a legitimate maintainer transition or an account compromise.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.13.23
2 findingsThis version was published by a different npm account than previous versions on 2026-01-05. This could indicate a legitimate maintainer transition or an account compromise.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.13.22
2 findingsThis version was published by a different npm account than previous versions on 2025-12-10. This could indicate a legitimate maintainer transition or an account compromise.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.13.21
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.13.11
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (lukasio) than the most recent previously approved version (thedavidzhao) on 2025-04-11, but lukasio is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v0.13.10
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.13.9
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.13.8
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.13.7
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.13.6
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.13.5
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.13.4
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.13.3
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.13.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.13.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.13.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.12.2
17 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.12.1
16 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.12.0
16 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.11.1
10 findingsModified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.11.0
10 findingsModified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.10.4
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.10.3
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.10.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.10.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.10.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.9.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.9.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.9.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.8.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.8.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.7.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.6.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.6.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.6.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.5.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.5.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.4.4
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.4.3
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.4.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.4.1
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (thedavidzhao) than the most recent previously approved version (feepslk) on 2024-06-07, but thedavidzhao is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.