← Home

@opentelemetry/instrumentation

npm Repository Homepage

Base class for node which OpenTelemetry instrumentation modules extend

83
Versions
Apache-2.0
License
No
Install Scripts
Verified
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures gitHead linked

Maintainers

dyladanpichlermarcoverbalancenpmjs-accounttrentmmartinkuba

Keywords

opentelemetrynodejsbrowsertracingprofilingmetricsstats

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
dependencies unvetted-dep:@opentelemetry/api-metrics AI (dependencies): @opentelemetry/api-metrics is a sibling package from the same OpenTelemetry monorepo, published by the same trusted team. This dependency relationship is stable and expected across all versions. ai
provenance no-provenance AI (provenance): This package predates Sigstore provenance adoption on npm. With 63.4M weekly downloads and a long-standing trusted publisher, lack of provenance is not a meaningful risk signal here. ai
provenance publisher-changed AI (provenance): dyladan and pichlermarc are both established OpenTelemetry maintainers; publisher rotation is routine for this org. SLSA provenance confirms CI/CD build. ai
dependencies unvetted-dep:@types/shimmer AI (dependencies): @types/shimmer is a type definition package for shimmer, a legitimate instrumentation utility. Unvetted but low-risk for this established package context. ai
phantom-deps phantom-dep:@types/shimmer AI (phantom-deps): Phantom dependency is expected for framework-scoped type definitions loaded by convention in OpenTelemetry instrumentation. ai
dependencies unvetted-dep:@opentelemetry/api-logs AI (dependencies): @opentelemetry/api-logs is a sibling package from the same official OpenTelemetry JS monorepo, published at matching versions via the same CI/CD pipeline with SLSA provenance. ai
dependencies unvetted-peer-dep:@opentelemetry/api AI (dependencies): @opentelemetry/api is the canonical OpenTelemetry API package; it is a well-known, widely-used package and a standard peer dep for all OpenTelemetry instrumentation packages. ai

Versions (showing 83 of 83)

Version Deps Published
0.221.0 3 / 23
0.220.0 3 / 23
0.219.0 3 / 23
0.218.0 3 / 23
0.217.0 3 / 23
0.216.0 3 / 23
0.215.0 3 / 23
0.214.0 3 / 23
0.213.0 3 / 23
0.212.0 3 / 23
0.211.0 3 / 23
0.210.0 3 / 23
0.209.0 3 / 23
0.208.0 3 / 24
0.207.0 3 / 24
0.206.0 3 / 24
0.205.0 3 / 25
0.204.0 3 / 25
0.203.0 3 / 26
0.202.0 3 / 26
0.201.1 5 / 26
0.201.0 5 / 26
0.200.0 5 / 27
0.57.2 6 / 28
0.57.1 6 / 28
0.57.0 6 / 28
0.56.0 6 / 28
0.55.0 6 / 28
0.54.2 6 / 28
0.54.1 6 / 28
0.54.0 6 / 29
0.53.0 6 / 29
0.52.1 6 / 30
0.52.0 6 / 30
0.51.1 6 / 30
0.51.0 6 / 30
0.50.0 6 / 31
0.49.1 6 / 31
0.49.0 5 / 31
0.48.0 5 / 30
0.47.0 5 / 29
0.46.0 5 / 29
0.45.1 5 / 29
0.45.0 5 / 29
0.44.0 5 / 29
0.43.0 5 / 29
0.42.0 5 / 29
0.41.2 5 / 29
0.39.1 3 / 28
0.39.0 3 / 28
0.38.0 3 / 29
0.37.0 3 / 29
0.36.1 3 / 29
0.36.0 3 / 29
0.35.1 3 / 29
0.35.0 3 / 29
0.34.0 3 / 28
0.33.0 4 / 28
0.32.0 4 / 28
0.31.0 4 / 28
0.30.0 4 / 28
0.29.2 4 / 28
0.29.1 4 / 28
0.29.0 4 / 28
0.28.0 4 / 28
0.27.0 4 / 28
0.26.0 4 / 28
0.25.0 4 / 28
0.24.0 4 / 28
0.23.0 4 / 29
0.22.0 4 / 29
0.21.0 4 / 29
0.20.0 4 / 29
0.19.0 4 / 30
0.18.2 5 / 29
0.18.1 5 / 29
0.18.0 5 / 29
0.17.0 5 / 29
0.16.0 5 / 29
0.15.0 5 / 29
0.14.0 4 / 29
0.13.0 4 / 29
0.12.0 4 / 29

v0.221.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.220.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.