← Home

@lodestar/api

npm Repository Homepage

A Typescript REST client for the Ethereum Consensus API

51
Versions
Apache-2.0
License
No
Install Scripts
Verified
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures gitHead linked

Maintainers

wemeetagainmatthewkeiljoshdougallkalambet

Keywords

ethereumeth-consensusbeaconapiblockchain

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
provenance publisher-changed AI (provenance): ChainSafe/lodestar migrated publishing from personal account 'wemeetagain' to GitHub Actions CI/CD with SLSA provenance. This is a legitimate, security-improving workflow change that generalizes to all future versions. ai
publish-pattern dormant-publish AI (publish-pattern): Apparent dormancy is an artifact of the publisher account change, not actual inactivity. Package has 2674 versions and is actively maintained by ChainSafe Systems. ai
typosquat typosquat.levenshtein:joi AI (typosquat): Scoped package @lodestar/api has no relation to 'joi'. Levenshtein match is a false positive for this well-known Ethereum project. ai
typosquat typosquat.levenshtein:ajv AI (typosquat): Scoped package @lodestar/api has no relation to 'ajv'. Levenshtein match is a false positive for this well-known Ethereum project. ai
dependencies unvetted-dep:@chainsafe/ssz AI (dependencies): @chainsafe/ssz is a first-party ChainSafe dependency used across the Lodestar monorepo for Ethereum SSZ serialization. Expected and stable. ai
typosquat typosquat.levenshtein:hapi AI (typosquat): @lodestar/api is a scoped package from ChainSafe Systems (Lodestar Ethereum client). Levenshtein match to 'hapi' is a false positive — no impersonation intent. ai
dependencies unvetted-dep:@lodestar/utils AI (dependencies): @lodestar/utils is an internal monorepo sibling package. Expected dependency for this package. ai
dependencies unvetted-dep:@lodestar/config AI (dependencies): @lodestar/config is an internal monorepo sibling package. Expected dependency for this package. ai
dependencies unvetted-dep:@chainsafe/persistent-merkle-tree AI (dependencies): @chainsafe/persistent-merkle-tree is a first-party ChainSafe dependency for Ethereum Merkle tree operations. Expected and stable. ai
dependencies unvetted-dep:@lodestar/types AI (dependencies): @lodestar/types is an internal monorepo sibling package. Expected dependency for this package. ai
typosquat typosquat.levenshtein:pg AI (typosquat): Scoped package @lodestar/api has no relation to 'pg'. Levenshtein match is a false positive for this well-known Ethereum project. ai

Versions (showing 51 of 71)

View all versions
Version Deps Published
1.45.0 8 / 4
1.44.0 8 / 4
1.43.0 8 / 4
1.42.0 8 / 4
1.41.1 8 / 4
1.41.0 8 / 4
1.40.0 8 / 4
1.39.1 8 / 4
1.39.0 8 / 4
1.38.0 8 / 4
1.37.0 8 / 4
1.36.0 8 / 4
1.35.0 8 / 4
1.34.1 8 / 4
1.34.0 8 / 4
1.33.0 8 / 4
1.32.0 8 / 4
1.31.0 8 / 4
1.30.0 8 / 4
1.29.0 8 / 4
1.28.1 8 / 4
1.28.0 8 / 4
1.27.1 8 / 4
1.27.0 8 / 4
1.26.0 8 / 4
1.25.0 8 / 4
1.24.0 8 / 4
1.23.1 8 / 4
1.23.0 8 / 4
1.22.0 8 / 4
1.21.0 8 / 4
1.20.2 8 / 4
1.20.1 8 / 4
1.20.0 8 / 4
1.19.0 8 / 4
1.18.1 8 / 4
1.18.0 8 / 4
1.17.0 8 / 4
1.16.0 8 / 4
1.15.1 8 / 4
1.15.0 8 / 4
1.14.0 8 / 4
1.13.0 8 / 4
1.12.1 8 / 4
1.12.0 8 / 4
1.11.3 8 / 4
1.11.2 8 / 4
1.11.1 8 / 4
1.11.0 8 / 4
1.10.0 8 / 4
1.9.2 9 / 4

v1.45.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.44.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.29.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.28.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.28.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.27.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.27.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.26.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.25.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.24.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.23.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.23.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.22.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.21.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.20.2

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.20.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.20.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.19.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.18.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.18.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.17.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.16.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.15.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.15.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.14.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.13.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.12.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.12.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.11.3

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.11.2

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.11.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.11.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.10.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.9.2

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.