@zed-industries/agent-client-protocol No license 17 versions

@zed-industries/agent-client-protocol

npm Repository Homepage

17

Versions

—

License

No

Install Scripts

Verified

Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures gitHead linked

Maintainers

piotr.osiewiczprobably-nebcirwinaguzubiagamaxdeviantmaxbrunsfeldbenbrandtcoleatzed

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
source-diff	source-size-dropped	AI (source-diff): Size drop reflects scoped `files` field shipping only dist/typescript artifacts, not full monorepo.	ai	2026/05/28
provenance	publisher-changed	AI (provenance): Transition from human publisher to GitHub Actions CI with SLSA attestation is a legitimate automation upgrade for zed-industries.	ai	2026/05/28
maintainer-change	maintainer-added	AI (maintainer-change): benbrandt is a known Zed Industries contributor; addition aligns with org-level CI publishing setup.	ai	2026/05/28
source-diff	encoded-string-file:typescript/docs/assets/search.js	AI (source-diff): Base64 content is TypeDoc-generated window.searchData; benign documentation artifact.	ai	2026/05/24
source-diff	encoded-string-file:typescript/docs/assets/hierarchy.js	AI (source-diff): Base64 content is TypeDoc-generated window.hierarchyData; benign documentation artifact.	ai	2026/05/24
source-diff	obfuscated-file:typescript/docs/assets/icons.js	AI (source-diff): TypeDoc-generated SVG icon sprite; minified docs asset, not executable attack surface.	ai	2026/05/23
source-diff	obfuscated-file:typescript/docs/assets/search.js	AI (source-diff): TypeDoc-generated search index; base64-encoded search data is expected for this tool.	ai	2026/05/23
source-diff	obfuscated-file:typescript/docs/assets/main.js	AI (source-diff): TypeDoc-generated bundled docs JS; standard minified output from typedoc build.	ai	2026/05/23

Versions (showing 17 of 17)

Version	Deps	Published
0.4.5	1 / 11	2025-10-02
0.4.4	1 / 11	2025-09-30
0.4.3	1 / 11	2025-09-25
0.4.2	1 / 11	2025-09-22
0.4.1	1 / 11	2025-09-22
0.4.0	1 / 11	2025-09-17
0.3.1	1 / 11	2025-09-15
0.3.0	1 / 11	2025-09-13
0.2.3	1 / 11	2025-09-12
0.2.1	1 / 11	2025-09-12
0.2.0	1 / 11	2025-09-12
0.1.2	1 / 11	2025-08-27
0.1.1	1 / 11	2025-08-27
0.1.0	1 / 11	2025-08-27
0.0.34	1 / 11	2025-08-27
0.0.33	1 / 11	2025-08-27
0.0.32	1 / 10	2025-08-27

v0.4.5

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.4.4

2 findings

HIGH Publisher changed: aguzubiaga → GitHub Actions (on 2025-09-30) provenance

This version was published by a different npm account than previous versions on 2025-09-30. This could indicate a legitimate maintainer transition or an account compromise.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.4.3

2 findings

HIGH Publisher changed: aguzubiaga → GitHub Actions (on 2025-09-25) provenance

This version was published by a different npm account than previous versions on 2025-09-25. This could indicate a legitimate maintainer transition or an account compromise.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.4.2

2 findings

HIGH Publisher changed: aguzubiaga → GitHub Actions (on 2025-09-22) provenance

This version was published by a different npm account than previous versions on 2025-09-22. This could indicate a legitimate maintainer transition or an account compromise.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.4.1

2 findings

HIGH Publisher changed: aguzubiaga → GitHub Actions (on 2025-09-22) provenance

This version was published by a different npm account than previous versions on 2025-09-22. This could indicate a legitimate maintainer transition or an account compromise.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.4.0

2 findings

HIGH Publisher changed: aguzubiaga → GitHub Actions (on 2025-09-17) provenance

This version was published by a different npm account than previous versions on 2025-09-17. This could indicate a legitimate maintainer transition or an account compromise.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.3.1

2 findings

HIGH Publisher changed: aguzubiaga → GitHub Actions (on 2025-09-15) provenance

This version was published by a different npm account than previous versions on 2025-09-15. This could indicate a legitimate maintainer transition or an account compromise.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.3.0

2 findings

HIGH Publisher changed: aguzubiaga → GitHub Actions (on 2025-09-13) provenance

This version was published by a different npm account than previous versions on 2025-09-13. This could indicate a legitimate maintainer transition or an account compromise.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.2.3

2 findings

HIGH Publisher changed: aguzubiaga → GitHub Actions (on 2025-09-12) provenance

This version was published by a different npm account than previous versions on 2025-09-12. This could indicate a legitimate maintainer transition or an account compromise.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.2.1

3 findings

HIGH Long encoded string in modified file: typescript/docs/assets/hierarchy.js source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: typescript/docs/assets/search.js source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.2.0

3 findings

HIGH Long encoded string in modified file: typescript/docs/assets/hierarchy.js source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: typescript/docs/assets/search.js source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.1.2

2 findings

HIGH Publisher changed: aguzubiaga → cirwin (on 2025-08-27) provenance

This version was published by a different npm account than previous versions on 2025-08-27. This could indicate a legitimate maintainer transition or an account compromise.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.1.1

3 findings

HIGH Long encoded string in modified file: typescript/docs/assets/hierarchy.js source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: typescript/docs/assets/search.js source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.1.0

5 findings

HIGH Publisher changed: cirwin → aguzubiaga (on 2025-08-27) provenance

This version was published by a different npm account than previous versions on 2025-08-27. This could indicate a legitimate maintainer transition or an account compromise.

HIGH New obfuscated file: typescript/docs/assets/icons.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: typescript/docs/assets/main.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: typescript/docs/assets/search.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.34

2 findings

HIGH Long encoded string in modified file: typescript/docs/assets/search.js source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.33

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.0.32

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.