@opentelemetry/host-metrics No license 45 versions

@opentelemetry/host-metrics

npm Repository Homepage

45

Versions

—

License

No

Install Scripts

Verified

Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures gitHead linked

Maintainers

dyladanpichlermarcoverbalancenpmjs-accounttrentmmartinkuba

Keywords

opentelemetrymetricsnodejstracingprofilingplugin

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
dependencies	unvetted-dep:systeminformation	AI (dependencies): systeminformation is a well-known, widely-used Node.js system info library; its use in a host-metrics package is expected and appropriate across all versions.	ai	2026/04/26

Versions (showing 45 of 45)

Version	Deps	Published
0.39.0	1 / 2	2026-06-11
0.38.3	1 / 2	2026-02-25
0.38.2	1 / 2	2026-01-22
0.38.1	1 / 2	2026-01-15
0.38.0	1 / 2	2025-12-17
0.37.0	1 / 9	2025-11-06
0.36.2	1 / 9	2025-09-29
0.36.1	1 / 9	2025-09-29
0.36.0	1 / 9	2025-03-18
0.35.5	1 / 9	2025-01-07
0.35.4	2 / 10	2024-10-08
0.35.3	2 / 10	2024-07-04
0.35.2	2 / 10	2024-06-06
0.35.1	2 / 10	2024-04-25
0.35.0	2 / 10	2024-01-29
0.34.1	2 / 10	2024-01-04
0.34.0	2 / 10	2023-12-07
0.33.2	2 / 10	2023-11-13
0.33.1	2 / 10	2023-08-14
0.33.0	3 / 10	2023-07-12
0.32.2	2 / 10	2023-05-16
0.32.1	2 / 11	2023-04-25
0.32.0	2 / 11	2023-04-06
0.31.0	2 / 11	2022-11-18
0.30.1	4 / 11	2022-09-29
0.30.0	4 / 11	2022-09-02
0.29.0	4 / 11	2022-06-15
0.28.0	4 / 11	2022-05-24
0.27.1	4 / 12	2022-01-24
0.27.0	4 / 12	2021-12-23
0.26.0	4 / 12	2021-10-25
0.25.0	4 / 12	2021-09-13
0.24.0	4 / 12	2021-07-29
0.23.0	4 / 12	2021-07-02
0.22.0	4 / 12	2021-06-23
0.21.0	4 / 12	2021-06-16
0.20.0	5 / 11	2021-06-04
0.16.0	5 / 11	2021-04-24
0.15.0	5 / 17	2021-04-05
0.14.0	5 / 17	2021-03-05
0.13.1	5 / 17	2021-02-10
0.13.0	5 / 17	2021-02-01
0.12.1	4 / 17	2021-01-15
0.12.0	4 / 17	2020-12-21
0.11.0	4 / 17	2020-10-31

v0.36.0

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v0.2). This is the strongest supply chain integrity signal.

v0.35.5

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v0.2). This is the strongest supply chain integrity signal.

v0.35.4

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v0.2). This is the strongest supply chain integrity signal.

v0.35.3

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v0.2). This is the strongest supply chain integrity signal.

v0.35.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.35.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.35.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.34.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.34.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.33.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.33.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.33.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.32.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.32.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.32.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.31.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.30.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.30.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.29.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.28.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.27.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.27.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.26.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.25.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.24.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.23.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.22.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.21.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.20.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.16.0

2 findings

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: obecny → dyladan (on 2021-04-24, known maintainer) provenance

This version was published by a different npm account (dyladan) than the most recent previously approved version (obecny) on 2021-04-24, but dyladan is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

v0.15.0

2 findings

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: obecny → dyladan (on 2021-04-05, known maintainer) provenance

This version was published by a different npm account (dyladan) than the most recent previously approved version (obecny) on 2021-04-05, but dyladan is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

v0.14.0

2 findings

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: dyladan → obecny (on 2021-03-05, known maintainer) provenance

This version was published by a different npm account (obecny) than the most recent previously approved version (dyladan) on 2021-03-05, but obecny is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

v0.13.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.13.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.12.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.12.0

2 findings

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: dyladan → obecny (on 2020-12-21, known maintainer) provenance

This version was published by a different npm account (obecny) than the most recent previously approved version (dyladan) on 2020-12-21, but obecny is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

v0.11.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.