@midwayjs/web
Midway Web Framework for Egg.js
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| publish-pattern | dormant-publish | AI (publish-pattern): Major version bump (v3→v4) explains the gap; established midwayjs monorepo package with long history. | ai | |
| publish-pattern | new-deps-added | AI (publish-pattern): egg-path-matching is a standard eggjs ecosystem utility, consistent with this package's eggjs integration purpose. | ai | |
| dependencies | unvetted-dep:egg-cluster | AI (dependencies): egg-cluster is a core egg ecosystem package; stable dependency for this package. | ai | |
| provenance | no-provenance | AI (provenance): Established Midway monorepo package; no provenance is consistent across all its versions. | ai | |
| dependencies | unvetted-dep:@midwayjs/core | AI (dependencies): Core Midway framework package from the same monorepo; stable dependency. | ai | |
| dependencies | unvetted-dep:@eggjs/router | AI (dependencies): Official eggjs router package; stable dependency for this package. | ai | |
| dependencies | unvetted-dep:egg | AI (dependencies): egg is a well-known Node.js framework; stable dependency for this package. | ai |
Versions (showing 10 of 10)
| Version | Deps | Published |
|---|---|---|
| 4.1.0 | 8 / 18 | |
| 4.0.3 | 8 / 18 | |
| 4.0.2 | 8 / 18 | |
| 4.0.1 | 8 / 18 | |
| 3.20.24 | 7 / 14 | |
| 3.20.23 | 7 / 14 | |
| 3.20.22 | 7 / 14 | |
| 3.20.19 | 7 / 14 | |
| 3.20.12 | 7 / 14 | |
| 3.20.11 | 7 / 14 |
v4.1.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.0.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.0.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.0.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.20.24
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v3.20.23
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v3.20.22
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v3.20.19
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v3.20.12
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v3.20.11
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.