← Home

@otplib/plugin-base32-scure

npm Repository Homepage
10
Versions
—
License
No
Install Scripts
Verified
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures No source commit

Maintainers

geraldyeo

Keywords

otpbase32encodingplugin

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
provenance publisher-changed AI (provenance): Publisher changed from geraldyeo to GitHub Actions as part of a CI/CD migration; SLSA provenance attestation confirms builds originate from the official yeojz/otplib repo. This is a stable, expected pattern for this package. ai
provenance slsa-provenance AI (provenance): SLSA provenance attestation is present and confirms supply chain integrity via Sigstore; stable positive signal for this package. ai
dependencies unvetted-dep:@otplib/core AI (dependencies): Sibling monorepo package from the same author/repo (yeojz/otplib); expected dependency pattern for this plugin package. ai

Versions (showing 10 of 10)

Version Deps Published
13.4.1 2 / 4
13.4.0 2 / 4
13.3.0 2 / 4
13.2.1 2 / 4
13.2.0 2 / 4
13.1.1 2 / 4
13.1.0 2 / 4
13.0.2 2 / 4
13.0.1 2 / 4
13.0.0 2 / 4

v13.4.1

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v13.4.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v13.1.1

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.