← Home

@x402/fetch

npm Repository
22
Versions
—
License
No
Install Scripts
Verified
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures No source commit

Maintainers

carsonroscoe_cberik_cb

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
bogus-package bogus-package AI (bogus-package): Signals reflect an early-stage v0.0.1 stub from Coinbase's x402 project. Tiny payload and minimal metadata are expected for a nascent release from a legitimate org with 47.8k weekly downloads. ai
provenance no-provenance AI (provenance): Coinbase's x402 packages do not currently publish with Sigstore provenance; this is consistent across the package family and not a risk indicator given the verified repo and publisher. ai
phantom-deps phantom-dep:zod AI (phantom-deps): zod is a declared runtime dependency in this monorepo package; phantom detection likely reflects indirect usage or re-export patterns. Not a security concern. ai
phantom-deps phantom-dep:viem AI (phantom-deps): viem is a declared runtime dependency; phantom detection likely reflects indirect usage patterns in this x402 fetch extension. Not a security concern. ai

Versions (showing 22 of 22)

Version Deps Published
2.20.0 1 / 15
2.19.0 1 / 15
2.18.0 1 / 15
2.17.0 1 / 15
2.16.0 1 / 15
2.15.0 1 / 15
2.14.0 1 / 15
2.13.0 1 / 15
2.12.0 1 / 15
2.11.0 3 / 15
2.10.0 3 / 15
2.9.0 3 / 15
2.8.0 3 / 15
2.7.0 3 / 15
2.6.0 3 / 15
2.5.0 3 / 15
2.4.0 3 / 15
2.3.0 3 / 15
2.2.0 3 / 15
2.1.0 3 / 15
2.0.0 3 / 15
0.0.1 0 / 0

v2.20.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v2.19.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v2.18.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.