cids
CID Implementation in JavaScript
44
Versions
MIT
License
No
Install Scripts
Missing
Provenance
Supply chain provenance
Status for the latest visible version.
No SLSA provenance
npm registry signatures
gitHead linked
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
vmxdaviddiasdignifiedquireachingbrainrvagg
Keywords
multihashcidipld
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | source-size-tripled | AI (source-diff): Size increase is entirely explained by addition of webpack dist bundles (browser build artifacts via aegir). The main entry point src/index.js is unchanged. | ai | |
| source-diff | net-exec-file:dist/index.js | AI (source-diff): dist/index.js is a standard webpack browser bundle produced by aegir build. The 'network + code execution' pattern is webpack's module loader boilerplate, not malicious dropper behavior. Stable for this package. | ai | |
| publish-pattern | new-deps-added | AI (publish-pattern): class-is is a well-known, legitimate IPFS/IPLD ecosystem utility for type-checking. No malicious signals. | ai | |
| semgrep | semgrep:hex-decode | AI (semgrep): Hardcoded literal hex byte '01' used as CID version prefix in encoding logic. Not payload obfuscation; stable false positive for this package. | ai | |
| typosquat | typosquat.levenshtein:cors | AI (typosquat): 'cids' is a legitimate IPFS Content Identifier package with no relation to 'cors'; the Levenshtein match is a false positive that will generalize across all versions. | ai | |
| provenance | publisher-changed | AI (provenance): achingbrain is a long-standing contributor to this package and the broader IPFS/multiformats ecosystem with 782 approved packages; transition from vmx is a legitimate org handoff. | ai | |
| maintainer-change | maintainer-added | AI (maintainer-change): achingbrain and rvagg are both listed contributors in package.json and known Protocol Labs/multiformats ecosystem maintainers; addition is a legitimate org-level change. | ai |
Versions (showing 44 of 44)
| Version | Deps | Published |
|---|---|---|
| 1.1.9 | 4 / 3 | |
| 1.1.8 | 4 / 3 | |
| 1.1.7 | 4 / 3 | |
| 1.1.6 | 4 / 3 | |
| 1.1.5 | 4 / 3 | |
| 1.1.4 | 4 / 3 | |
| 1.1.3 | 4 / 3 | |
| 1.1.2 | 4 / 3 | |
| 1.1.1 | 4 / 3 | |
| 1.1.0 | 4 / 2 | |
| 1.0.2 | 5 / 2 | |
| 1.0.1 | 5 / 2 | |
| 1.0.0 | 5 / 2 | |
| 0.8.3 | 5 / 4 | |
| 0.8.2 | 5 / 5 | |
| 0.8.1 | 5 / 5 | |
| 0.8.0 | 5 / 5 | |
| 0.7.5 | 5 / 5 | |
| 0.7.4 | 5 / 5 | |
| 0.7.3 | 4 / 5 | |
| 0.7.2 | 4 / 5 | |
| 0.7.1 | 4 / 5 | |
| 0.7.0 | 4 / 5 | |
| 0.6.0 | 4 / 5 | |
| 0.5.8 | 4 / 5 | |
| 0.5.7 | 4 / 5 | |
| 0.5.6 | 4 / 6 | |
| 0.5.5 | 4 / 6 | |
| 0.5.4 | 4 / 6 | |
| 0.5.3 | 3 / 6 | |
| 0.5.2 | 3 / 5 | |
| 0.5.1 | 3 / 5 | |
| 0.5.0 | 3 / 5 | |
| 0.4.2 | 3 / 4 | |
| 0.4.1 | 3 / 4 | |
| 0.4.0 | 3 / 4 | |
| 0.3.6 | 3 / 4 | |
| 0.3.5 | 3 / 4 | |
| 0.3.4 | 3 / 4 | |
| 0.3.3 | 3 / 4 | |
| 0.3.2 | 3 / 4 | |
| 0.3.0 | 3 / 4 | |
| 0.2.0 | 3 / 4 | |
| 0.1.1 | 2 / 4 |