@traceloop/instrumentation-langchain No license 31 versions

@traceloop/instrumentation-langchain

npm Repository Homepage

31

Versions

—

License

No

Install Scripts

Verified

Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures gitHead linked

Maintainers

tomer-friedmannirgagalklm

Keywords

opentelemetrynodejstracingattributeslangchain

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
provenance	publisher-changed	AI (provenance): Migrated to GitHub Actions CI/CD publishing with SLSA provenance; legitimate transition.	ai	2026/06/07
publish-pattern	dormant-publish	AI (publish-pattern): Monorepo release cadence; dormancy reflects normal development cycles for this org.	ai	2026/06/07
phantom-deps	phantom-dep:tslib	AI (phantom-deps): tslib is a known implicit dependency for TypeScript transpilation; stable pattern.	ai	2026/05/27
phantom-deps	phantom-dep:@opentelemetry/core	AI (phantom-deps): OpenTelemetry core is implicitly required by instrumentation; stable for this package.	ai	2026/05/27
phantom-deps	phantom-dep:@opentelemetry/semantic-conventions	AI (phantom-deps): Semantic conventions implicitly required by instrumentation; stable for this package.	ai	2026/05/27

Versions (showing 31 of 31)

Version	Deps	Published
0.27.0	7 / 17	2026-06-01
0.26.0	7 / 17	2026-04-16
0.25.0	7 / 17	2026-04-13
0.24.0	7 / 17	2026-04-06
0.23.0	7 / 14	2026-03-30
0.22.6	7 / 14	2026-01-18
0.22.5	7 / 14	2025-12-17
0.22.2	7 / 14	2025-12-02
0.22.0	7 / 14	2025-11-27
0.21.0	7 / 14	2025-11-24
0.20.0	7 / 14	2025-11-04
0.19.0	7 / 14	2025-09-17
0.18.0	7 / 14	2025-08-24
0.17.0	7 / 14	2025-08-18
0.16.0	7 / 12	2025-08-14
0.15.0	7 / 12	2025-08-11
0.14.6	7 / 12	2025-07-28
0.14.5	7 / 12	2025-07-26
0.14.4	5 / 12	2025-07-21
0.14.0	5 / 9	2025-07-04
0.13.0	5 / 9	2025-04-22
0.12.0	5 / 9	2025-01-13
0.11.6	5 / 9	2024-12-16
0.11.4	5 / 9	2024-11-13
0.11.1	5 / 9	2024-08-31
0.11.0	5 / 10	2024-08-27
0.10.0	5 / 10	2024-08-01
0.9.2	5 / 10	2024-07-17
0.9.0	4 / 10	2024-07-04
0.8.8	4 / 10	2024-06-16
0.8.6	4 / 10	2024-06-03

v0.27.0

2 findings

HIGH Publisher changed: galklm → GitHub Actions (on 2026-06-01) provenance

This version was published by a different npm account than previous versions on 2026-06-01. This could indicate a legitimate maintainer transition or an account compromise.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.26.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.25.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.24.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.23.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.22.6

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.22.5

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.22.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.22.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.21.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.20.0

2 findings

HIGH Publisher changed: nirga → galklm (on 2025-11-04) provenance

This version was published by a different npm account than previous versions on 2025-11-04. This could indicate a legitimate maintainer transition or an account compromise.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.19.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.18.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.17.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.16.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.15.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.14.6

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.14.5

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.14.4

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.14.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.13.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.12.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.11.6

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.11.4

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.11.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.11.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.10.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.9.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.9.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.8.8

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.8.6

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.