← Home

@usebruno/requests

npm
17
Versions
—
License
No
Install Scripts
Missing
Provenance

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.

Maintainers

anoopmd

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
phantom-deps phantom-dep:google-protobuf AI (phantom-deps): Used via generated proto code, not direct import. ai
source-diff large-new-source-files AI (source-diff): New gRPC/proto feature files, not injected code. ai
source-diff source-size-tripled AI (source-diff): Size increase matches new gRPC/reflection deps bundled for feature support. ai
bogus-package bogus-package AI (bogus-package): Scoped utility package; missing metadata is common and not indicative of malice here. ai
phantom-deps phantom-dep:@types/qs AI (phantom-deps): @types packages are framework-loaded by convention; stable for this package. ai
typosquat typosquat.levenshtein:request AI (typosquat): Scoped @usebruno org package; not a typosquat of 'request', stable across all versions. ai
semgrep semgrep:shady-links-raw-ip AI (semgrep): Raw IPs are localhost (127.0.0.1:8200) in unit test assertions for Vault client; not production network calls. ai
semgrep semgrep:env-spread AI (semgrep): Fires only in test spec file saving/restoring process.env; not production code. ai

Versions (showing 17 of 17)

Version Deps Published
0.18.0 17 / 16
0.17.0 17 / 16
0.16.2 15 / 16
0.16.1 15 / 16
0.16.0 15 / 16
0.15.2 14 / 16
0.15.1 14 / 16
0.15.0 14 / 16
0.14.0 11 / 16
0.13.0 11 / 16
0.7.0 2 / 13
0.6.0 2 / 13
0.5.0 2 / 8
0.4.0 2 / 8
0.3.0 1 / 8
0.2.0 1 / 8
0.1.0 0 / 8

v0.16.2

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.16.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.16.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.15.2

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.15.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.15.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.14.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.13.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.1.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.