← Home

@otplib/plugin-crypto-noble

npm Repository Homepage
10
Versions
—
License
No
Install Scripts
Verified
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures No source commit

Maintainers

geraldyeo

Keywords

otpcryptonoble-hasheshmacpluginbrowser

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
provenance publisher-changed AI (provenance): Publisher changed from geraldyeo to GitHub Actions for the yeojz/otplib repo — a legitimate CI/CD migration confirmed by SLSA provenance attestation. Stable for this package going forward. ai
provenance slsa-provenance AI (provenance): Package consistently publishes with SLSA provenance via GitHub Actions; this is a positive signal, not a risk. ai
dependencies unvetted-dep:@otplib/core AI (dependencies): @otplib/core is the sibling core package of the same otplib monorepo; its presence as a dependency of this plugin is expected and not a risk signal. ai

Versions (showing 10 of 10)

Version Deps Published
13.4.1 2 / 3
13.4.0 2 / 3
13.3.0 2 / 3
13.2.1 2 / 3
13.2.0 2 / 3
13.1.1 2 / 3
13.1.0 2 / 3
13.0.2 2 / 3
13.0.1 2 / 3
13.0.0 2 / 3

v13.4.1

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v13.4.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v13.1.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.