@n8n/db
Supply chain provenance
Status for the latest visible version.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| provenance | publisher-changed | AI (provenance): Transition from manual publish (tomin8n) to GitHub Actions CI/CD with SLSA attestation is a provenance improvement, not a risk. | ai | |
| publish-pattern | new-deps-added | AI (publish-pattern): @n8n/utils is a first-party n8n monorepo package; not a suspicious third-party dep. | ai | |
| maintainer-change | maintainer-removed | AI (maintainer-change): Same as above — removal paired with addition consistent with username change, not takeover. | ai | |
| maintainer-change | maintainer-added | AI (maintainer-change): Appears to be an n8n org username rename; SLSA provenance and official repo confirm legitimate CI/CD publish. | ai | |
| publish-pattern | rapid-publish | AI (publish-pattern): n8n monorepo uses automated CI/CD with SLSA provenance; rapid publishes are expected across coordinated package releases. | ai | |
| license | uncommon-license:SEE LICENSE IN LICENSE.md | AI (license): Dual-license pattern (OSS + EE); stable for n8n packages. | ai | |
| source-diff | large-new-source-files | AI (source-diff): Active n8n monorepo package; new source files are expected across frequent releases. | ai | |
| npm-metadata | no-description | AI (npm-metadata): Internal monorepo package; missing description is a known pattern, not a malware signal here. | ai | |
| dependencies | unvetted-dep:@n8n/typeorm | AI (dependencies): Internal n8n fork of TypeORM; stable dependency for this package. | ai | |
| dependencies | unvetted-dep:p-lazy | AI (dependencies): p-lazy is a well-known sindresorhus utility; stable dependency for this package. | ai | |
| typosquat | typosquat.levenshtein:pg | AI (typosquat): Scoped @n8n/db is an internal n8n package, not a typosquat of pg. | ai | |
| phantom-deps | phantom-dep:reflect-metadata | AI (phantom-deps): reflect-metadata is a known implicit runtime dep for TypeORM/decorator-based packages. | ai | |
| typosquat | typosquat.levenshtein:qs | AI (typosquat): Scoped @n8n/db is an internal n8n package, not a typosquat of qs. | ai |
Versions (showing 100 of 188)
| Version | Deps | Published |
|---|---|---|
| 1.32.2 | 20 / 13 | |
| 1.32.1 | 20 / 13 | |
| 1.32.0 | 20 / 13 | |
| 1.31.4 | 20 / 12 | |
| 1.31.3 | 20 / 12 | |
| 1.31.2 | 20 / 12 | |
| 1.31.1 | 20 / 12 | |
| 1.31.0 | 20 / 12 | |
| 1.30.4 | 20 / 12 | |
| 1.30.3 | 20 / 12 | |
| 1.30.2 | 20 / 12 | |
| 1.30.1 | 20 / 12 | |
| 1.30.0 | 20 / 12 | |
| 1.29.8 | 20 / 11 | |
| 1.29.7 | 20 / 11 | |
| 1.29.6 | 20 / 11 | |
| 1.29.5 | 20 / 11 | |
| 1.29.4 | 20 / 11 | |
| 1.29.3 | 20 / 11 | |
| 1.29.2 | 20 / 11 | |
| 1.29.1 | 20 / 11 | |
| 1.29.0 | 20 / 11 | |
| 1.28.5 | 20 / 10 | |
| 1.28.4 | 20 / 10 | |
| 1.28.3 | 20 / 10 | |
| 1.28.2 | 20 / 10 | |
| 1.28.1 | 20 / 10 | |
| 1.28.0 | 20 / 10 | |
| 1.27.4 | 20 / 9 | |
| 1.27.3 | 20 / 9 | |
| 1.27.2 | 20 / 9 | |
| 1.27.1 | 20 / 9 | |
| 1.27.0 | 20 / 9 | |
| 1.26.4 | 20 / 8 | |
| 1.26.3 | 20 / 8 | |
| 1.26.2 | 20 / 8 | |
| 1.26.1 | 20 / 8 | |
| 1.26.0 | 20 / 8 | |
| 1.25.2 | 20 / 3 | |
| 1.25.1 | 20 / 3 | |
| 1.25.0 | 20 / 3 | |
| 1.24.0 | 20 / 3 | |
| 1.23.1 | 20 / 3 | |
| 1.23.0 | 20 / 3 | |
| 1.22.4 | 20 / 3 | |
| 1.22.3 | 20 / 3 | |
| 1.22.2 | 20 / 3 | |
| 1.22.1 | 20 / 3 | |
| 1.22.0 | 20 / 3 | |
| 1.21.5 | 20 / 3 | |
| 1.21.4 | 20 / 3 | |
| 1.21.3 | 20 / 3 | |
| 1.21.2 | 20 / 3 | |
| 1.21.1 | 20 / 3 | |
| 1.21.0 | 20 / 3 | |
| 1.20.6 | 20 / 3 | |
| 1.20.5 | 20 / 3 | |
| 1.20.4 | 20 / 3 | |
| 1.20.3 | 20 / 3 | |
| 1.20.2 | 20 / 3 | |
| 1.20.1 | 20 / 3 | |
| 1.20.0 | 20 / 3 | |
| 1.19.4 | 20 / 3 | |
| 1.19.3 | 20 / 3 | |
| 1.19.2 | 20 / 3 | |
| 1.19.1 | 20 / 3 | |
| 1.19.0 | 20 / 3 | |
| 1.18.5 | 20 / 3 | |
| 1.18.4 | 20 / 3 | |
| 1.18.3 | 20 / 3 | |
| 1.18.2 | 20 / 3 | |
| 1.18.1 | 20 / 3 | |
| 1.18.0 | 20 / 3 | |
| 1.17.3 | 20 / 3 | |
| 1.17.2 | 20 / 3 | |
| 1.17.1 | 20 / 3 | |
| 1.17.0 | 20 / 3 | |
| 1.16.1 | 20 / 3 | |
| 1.16.0 | 20 / 3 | |
| 1.15.0 | 20 / 3 | |
| 1.14.1 | 20 / 3 | |
| 1.14.0 | 20 / 3 | |
| 1.13.1 | 20 / 3 | |
| 1.13.0 | 20 / 3 | |
| 1.12.0 | 20 / 3 | |
| 1.11.1 | 20 / 3 | |
| 1.11.0 | 20 / 3 | |
| 1.10.3 | 20 / 3 | |
| 1.10.2 | 20 / 3 | |
| 1.10.1 | 20 / 3 | |
| 1.10.0 | 20 / 3 | |
| 1.9.1 | 20 / 3 | |
| 1.9.0 | 20 / 3 | |
| 1.8.2 | 20 / 3 | |
| 1.8.1 | 20 / 3 | |
| 1.8.0 | 20 / 3 | |
| 1.7.4 | 20 / 3 | |
| 1.7.3 | 20 / 3 | |
| 1.7.2 | 20 / 3 | |
| 1.7.1 | 20 / 3 |
v1.32.2
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.32.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.32.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.31.4
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.31.3
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.31.2
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.31.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.31.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.30.4
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.30.3
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.30.2
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.30.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.30.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.29.8
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.29.7
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.29.6
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.29.5
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.29.4
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.29.3
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.29.2
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.29.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.29.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.28.5
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.28.4
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.28.3
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.28.2
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.28.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.28.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.27.4
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.27.3
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.27.2
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.27.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.26.4
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.26.3
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.26.2
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.26.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.25.2
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.25.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.25.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.24.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.23.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.23.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.22.3
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.22.2
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.22.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.21.5
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.21.4
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.21.2
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.21.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.20.6
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.20.5
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.20.3
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.20.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.20.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.19.4
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.18.3
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.18.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.17.3
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.17.2
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.16.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.14.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.10.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.9.0
2 findingsThis version was published by a different npm account than previous versions on 2026-02-16. This could indicate a legitimate maintainer transition or an account compromise.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.8.0
2 findingsThis version was published by a different npm account than previous versions on 2026-02-11. This could indicate a legitimate maintainer transition or an account compromise.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.7.4
2 findingsPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
This version was published by a different npm account (tomin8n) than the most recent previously approved version (GitHub Actions) on 2026-02-13, but tomin8n is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.