← Home

bare-structured-clone

npm Repository Homepage
18
Versions
—
License
No
Install Scripts
Verified
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures gitHead linked

Maintainers

mafintosh

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
publish-pattern dormant-publish AI (publish-pattern): SLSA provenance attestation confirms CI/CD publish; dormancy is explained by infrequent releases for a stable native addon. ai
npm-metadata bundled-binaries AI (npm-metadata): Native addon package from Holepunch; prebuilds are expected and covered by SLSA provenance attestation. ai
dependencies unvetted-dep:bare-buffer AI (dependencies): bare-buffer is a Holepunch ecosystem package consistent with this org's native addon dependencies. ai

Versions (showing 18 of 18)

Version Deps Published
1.6.0 4 / 5
1.5.5 4 / 5
1.5.4 4 / 5
1.5.3 2 / 6
1.5.2 2 / 6
1.5.1 2 / 6
1.5.0 2 / 6
1.4.3 2 / 6
1.4.2 2 / 6
1.4.1 2 / 6
1.4.0 4 / 6
1.3.0 4 / 4
1.2.6 4 / 3
1.2.5 4 / 2
1.2.4 4 / 2
1.2.3 4 / 2
1.2.2 4 / 2
1.2.1 4 / 2

v1.4.2

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.4.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.4.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.3.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.2.6

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.2.5

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.2.4

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.2.3

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.2.2

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.2.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.