← Home

@stacks/bns

npm Repository Homepage
9
Versions
—
License
No
Install Scripts
Verified
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures gitHead linked

Maintainers

blockstack-devopsstacks-foundationjannik-stacksrafa-stacks

Keywords

BNSBlockchainBlockstackNamingStacksSystem

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
provenance publisher-changed AI (provenance): Transition to GitHub Actions CI publisher with SLSA attestation; consistent with Hiro Systems org-level CI/CD migration. ai
maintainer-change maintainer-added AI (maintainer-change): New maintainers are stacks-org accounts; consistent with legitimate team transition at Hiro Systems. ai
maintainer-change maintainer-removed AI (maintainer-change): Removal of zone117x alongside addition of org accounts consistent with planned maintainer rotation. ai
typosquat typosquat.levenshtein:qs AI (typosquat): Scoped @stacks package from Hiro Systems; edit-distance match to 'qs' is a heuristic false positive. ai

Versions (showing 9 of 9)

Version Deps Published
7.5.0 3 / 2
7.4.0 3 / 2
7.2.0 3 / 2
7.1.0 3 / 2
7.0.6 3 / 2
7.0.5 3 / 2
7.0.4 3 / 2
7.0.2 3 / 2
7.0.0 3 / 2

v7.0.6

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v7.0.5

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v7.0.4

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v7.0.2

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v7.0.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.