← Home

exponential-backoff

npm Repository Homepage

A utility that allows retrying a function with an exponential delay between attempts.

6
Versions
Apache-2.0
License
No
Install Scripts
Verified
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures gitHead linked

Maintainers

aboissinotcoveo-organizationcoveoitolamothesssayeghylakhdarndlrnpmcoveopixhelmmitichenlegrossallainmsriouxtalao-coveooa-npmcoveo

Keywords

exponentialbackoffretry

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
maintainer-change maintainer-takeover AI (maintainer-change): Known-maintainer org rename, long-lived, no behavior change; stable false positive. ai
maintainer-change maintainer-added AI (maintainer-change): Same entity as removed maintainer, matched via email/provenance. ai
maintainer-change maintainer-removed AI (maintainer-change): Superseded by org account rename, not a takeover. ai

Versions (showing 6 of 6)

Version Deps Published
3.1.3 0 / 8
3.1.2 0 / 8
3.1.1 0 / 8
3.1.0 0 / 8
3.0.1 0 / 8
3.0.0 0 / 8

v3.1.1

2 findings
MEDIUM Publisher changed: coveo → sssayegh (on 2023-02-20, unremoved on npm for 1246d) provenance

This version was published by a different npm account (sssayegh) than the most recent previously approved version (coveo) on 2023-02-20. It has since remained available on npm for 1246 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.1.0

2 findings
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: coveo → coveo-organization (on 2020-08-06, known maintainer) provenance

This version was published by a different npm account (coveo-organization) than the most recent previously approved version (coveo) on 2020-08-06, but coveo-organization is listed as a maintainer on prior approved versions (matched on email). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

v3.0.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.0.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.