@qvac/registry-client
11
Versions
—
License
No
Install Scripts
Verified
Provenance
Supply chain provenance
Status for the latest visible version.
SLSA provenance attestation
npm registry signatures
gitHead linked
Maintainers
mafintoshprdn
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| phantom-deps | phantom-dep:process | AI (phantom-deps): Bare process shim aliased via npm: protocol. | ai | |
| dependencies | unvetted-dep:b4a | AI (dependencies): Well-known Hypercore-ecosystem buffer utility, widely used and safe. | ai | |
| dependencies | unvetted-dep:@qvac/registry-schema | AI (dependencies): Sibling package from same monorepo/org. | ai | |
| dependencies | unvetted-dep:hyperswarm-stats | AI (dependencies): Official Hyperswarm stats lib, matches package's stated function. | ai | |
| dependencies | unvetted-dep:hypercore-stats | AI (dependencies): Official Hypercore-ecosystem stats lib, matches package's Hyperswarm purpose. | ai | |
| semgrep | semgrep:hex-decode | AI (semgrep): Legit hex decode of hypercore key buffer, not payload hiding. | ai | |
| provenance | publisher-changed | AI (provenance): Transition to GitHub Actions CI publishing is confirmed by SLSA Sigstore attestation; legitimate automation handoff. | ai | |
| maintainer-change | maintainer-removed | AI (maintainer-change): Removal of subash.77 aligns with move to automated CI publishing; SLSA attestation confirms integrity. | ai | |
| phantom-deps | phantom-dep:bare-process | AI (phantom-deps): Bare runtime compat dep; legitimately declared even if not directly imported. | ai | |
| phantom-deps | phantom-dep:bare-path | AI (phantom-deps): Used via package.json imports map for Bare/Node compat; not directly required but legitimately declared. | ai | |
| phantom-deps | phantom-dep:hyperdb | AI (phantom-deps): Core Holepunch dep; phantom-dep heuristic false positive for this ecosystem. | ai | |
| phantom-deps | phantom-dep:bare-fs | AI (phantom-deps): Used via package.json imports map for Bare/Node compat; not directly required but legitimately declared. | ai | |
| phantom-deps | phantom-dep:bare-os | AI (phantom-deps): Used via package.json imports map for Bare/Node compat; not directly required but legitimately declared. | ai | |
| phantom-deps | phantom-dep:b4a | AI (phantom-deps): Standard Holepunch buffer utility; phantom-dep heuristic false positive for this ecosystem. | ai |
Versions (showing 11 of 11)
| Version | Deps | Published |
|---|---|---|
| 0.6.1 | 16 / 5 | |
| 0.6.0 | 16 / 5 | |
| 0.5.0 | 13 / 9 | |
| 0.4.1 | 17 / 5 | |
| 0.4.0 | 17 / 5 | |
| 0.3.0 | 17 / 5 | |
| 0.2.1 | 14 / 5 | |
| 0.2.0 | 14 / 5 | |
| 0.1.8 | 14 / 5 | |
| 0.1.6 | 17 / 5 | |
| 0.1.5 | 17 / 5 |
v0.6.1
2 findings
HIGH
Publisher changed: subash.77 → GitHub Actions (on 2026-06-26)
provenance
This version was published by a different npm account than previous versions on 2026-06-26. This could indicate a legitimate maintainer transition or an account compromise.
INFO
Has SLSA provenance attestation
provenance
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.