body-parser
Node.js body parsing middleware
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| provenance | publisher-changed | AI (provenance): wesleytodd is a known Express.js ecosystem maintainer with a long history; publisher change reflects a legitimate org-level maintainer transition for expressjs/body-parser. | ai | |
| maintainer-change | maintainer-added | AI (maintainer-change): wesleytodd is an established Express.js contributor; addition is consistent with a legitimate maintainer transition within the expressjs GitHub org. | ai | |
| dependencies | unvetted-dep:raw-body | AI (dependencies): raw-body is a standard Express ecosystem dependency maintained by the same org; no actual risk. | ai | |
| dependencies | unvetted-dep:qs | AI (dependencies): qs is a well-established Express ecosystem dependency; unvetted flag reflects pipeline state, not actual risk for this package. | ai | |
| provenance | no-provenance | AI (provenance): Lack of provenance is common across npm; for an established package with a known publisher and repo, this is not a meaningful risk signal. | ai | |
| dependencies | unvetted-dep:http-errors | AI (dependencies): http-errors is a well-known Express ecosystem dependency; no actual risk. | ai | |
| dependencies | unvetted-dep:type-is | AI (dependencies): type-is is a standard Express ecosystem dependency maintained by the same org; no actual risk. | ai |
Versions (showing 11 of 11)
| Version | Deps | Published |
|---|---|---|
| 2.3.0 | 9 / 10 | |
| 2.2.2 | 9 / 10 | |
| 2.2.1 | 9 / 10 | |
| 2.2.0 | 9 / 10 | |
| 2.1.0 | 9 / 10 | |
| 2.0.2 | 10 / 11 | |
| 2.0.1 | 11 / 12 | |
| 2.0.0 | 11 / 12 | |
| 1.20.5 | 12 / 12 | |
| 1.20.4 | 12 / 12 | |
| 1.20.3 | 12 / 12 |
v2.3.0
2 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (ulisesgascon) than the most recent previously approved version (jonchurch) on 2026-06-15, but ulisesgascon is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v1.20.5
2 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2026-04-24. This could indicate a legitimate maintainer transition or an account compromise.