@nostr-wot/wot
Web-of-Trust scoring + extension bridge for Nostr. WoT class, distance/scoring, browser extension integration, React + Solid hooks.
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| typosquat | typosquat.levenshtein:got | AI (typosquat): Scoped @nostr-wot/wot is a Nostr WoT SDK; 'wot' suffix matching 'got' is coincidental, not impersonation. | ai | |
| typosquat | typosquat.levenshtein:koa | AI (typosquat): Same reasoning; scoped package name has no relation to koa. | ai | |
| typosquat | typosquat.levenshtein:joi | AI (typosquat): Same reasoning; scoped package name has no relation to joi. | ai | |
| typosquat | typosquat.levenshtein:zod | AI (typosquat): Same reasoning; scoped package name has no relation to zod. | ai | |
| phantom-deps | phantom-dep:@nostr-wot/data | AI (phantom-deps): Same-org sibling package declared as runtime dependency; likely imported in dist but not detected in source scan. | ai |
Versions (showing 6 of 6)
| Version | Deps | Published |
|---|---|---|
| 0.1.5 | 1 / 0 | |
| 0.1.4 | 1 / 0 | |
| 0.1.3 | 1 / 0 | |
| 0.1.2 | 1 / 0 | |
| 0.1.1 | 1 / 0 | |
| 0.1.0 | 1 / 0 |
v0.1.4
2 findingsPackage name '@nostr-wot/wot' is 1 edit(s) away from popular package 'got'.
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.1.3
2 findingsPackage name '@nostr-wot/wot' is 1 edit(s) away from popular package 'got'.
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.1.2
2 findingsPackage name '@nostr-wot/wot' is 1 edit(s) away from popular package 'got'.
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.1.1
2 findingsPackage name '@nostr-wot/wot' is 1 edit(s) away from popular package 'got'.
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.1.0
2 findingsPackage name '@nostr-wot/wot' is 1 edit(s) away from popular package 'got'.
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.