@microsoft/signalr

Supply chain provenance

Status for the latest visible version.

Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.

Maintainers

Keywords

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
phantom-deps	phantom-dep:ws	AI (phantom-deps): ws is a legitimate Node.js WebSocket library declared as a runtime dep for SignalR's Node.js transport support; phantom-dep pattern is expected for this package.	ai	2026/04/25
phantom-deps	phantom-dep:node-fetch	AI (phantom-deps): node-fetch is a legitimate fetch polyfill declared as a runtime dep for Node.js environments; phantom-dep pattern is expected for this package.	ai	2026/04/25
phantom-deps	phantom-dep:eventsource	AI (phantom-deps): eventsource is a legitimate SSE library declared as a runtime dep for SignalR's Server-Sent Events transport in Node.js; phantom-dep pattern is expected.	ai	2026/04/25
phantom-deps	phantom-dep:fetch-cookie	AI (phantom-deps): fetch-cookie is a legitimate cookie jar library declared as a runtime dep for cookie-based auth support; phantom-dep pattern is expected for this package.	ai	2026/04/25
phantom-deps	phantom-dep:abort-controller	AI (phantom-deps): abort-controller is a legitimate polyfill declared as a runtime dep for Node.js environments; phantom-dep pattern is expected for this package.	ai	2026/04/25
dependencies	unvetted-dep:fetch-cookie	AI (dependencies): fetch-cookie is a well-known npm package used for cookie jar support with node-fetch; its use in SignalR for cookie-based auth is legitimate and expected.	ai	2026/04/25

Version	Deps	Published
10.0.0	5 / 0	2025-11-14