← Home

@lodestar/validator

npm Repository Homepage

A Typescript implementation of the validator client

38
Versions
Apache-2.0
License
No
Install Scripts
Verified
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures gitHead linked

Maintainers

wemeetagainmatthewkeiljoshdougallkalambet

Keywords

ethereumeth-consensusbeaconblockchain

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
provenance publisher-changed AI (provenance): Publisher changed to GitHub Actions CI/CD with SLSA provenance attestation — this is a deliberate, security-improving migration for the ChainSafe/lodestar monorepo. ai
publish-pattern dormant-publish AI (publish-pattern): Lodestar is an active Ethereum consensus client with 2669 versions and 4.9k weekly downloads; SLSA attestation confirms legitimate CI/CD publishing. ai
semgrep semgrep:shady-links-raw-ip AI (semgrep): The flagged IP is 127.0.0.1 (localhost), used as a default local RPC endpoint config. This is standard practice for Ethereum client tooling and not a malicious remote connection. ai

Versions (showing 38 of 38)

Version Deps Published
1.45.0 10 / 5
1.44.0 10 / 5
1.43.0 10 / 5
1.42.0 10 / 5
1.41.1 10 / 5
1.41.0 10 / 5
1.40.0 10 / 5
1.39.1 10 / 5
1.39.0 10 / 5
1.38.0 10 / 3
1.37.0 10 / 3
1.36.0 10 / 3
1.35.0 10 / 3
1.34.1 10 / 3
1.34.0 10 / 3
1.33.0 10 / 3
1.32.0 10 / 3
1.31.0 10 / 3
1.30.0 10 / 3
1.29.0 10 / 3
1.28.1 10 / 3
1.28.0 10 / 3
1.27.1 10 / 3
1.27.0 10 / 3
1.26.0 10 / 3
1.25.0 10 / 3
1.24.0 10 / 3
1.23.1 10 / 3
1.23.0 10 / 3
1.22.0 10 / 3
1.21.0 10 / 3
1.20.2 10 / 3
1.20.1 10 / 3
1.20.0 10 / 3
1.19.0 10 / 3
1.18.1 10 / 3
1.18.0 10 / 3
1.17.0 10 / 3

v1.45.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.44.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.29.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.28.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.28.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.27.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.27.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.26.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.25.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.24.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.23.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.23.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.22.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.21.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.20.2

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.20.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.20.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.19.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.18.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.18.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.17.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.