hyperdht
8
Versions
—
License
No
Install Scripts
Verified
Provenance
Supply chain provenance
Status for the latest visible version.
SLSA provenance attestation
npm registry signatures
gitHead linked
Maintainers
mafintosh
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| maintainer-change | maintainer-removed | AI (maintainer-change): No accompanying code changes or new suspicious maintainers; routine org roster change. | ai | |
| provenance | publisher-changed | AI (provenance): holepunchto org uses GitHub Actions for publishing; SLSA attestation confirms CI-based release pipeline. | ai | |
| publish-pattern | dormant-publish | AI (publish-pattern): SLSA provenance attestation and no code changes confirm legitimate release despite dormancy gap. | ai | |
| dependencies | unvetted-dep:dht-rpc | AI (dependencies): Core DHT-RPC layer for hyperdht; stable Holepunch ecosystem dependency. | ai | |
| dependencies | unvetted-dep:streamx | AI (dependencies): Well-known Holepunch streams library; stable dependency across versions. | ai | |
| dependencies | unvetted-dep:blind-relay | AI (dependencies): Holepunch relay library; stable dependency for hyperdht. | ai | |
| dependencies | unvetted-dep:b4a | AI (dependencies): Known Holepunch ecosystem utility; stable dependency across hyperdht versions. | ai | |
| phantom-deps | phantom-dep:streamx | AI (phantom-deps): streamx is used via conditional imports pattern; phantom-dep is a false positive here. | ai | |
| phantom-deps | phantom-dep:bare-events | AI (phantom-deps): bare-events is referenced via package.json imports map for Bare runtime; not a direct import by design. | ai | |
| dependencies | unvetted-dep:hyperdht-address | AI (dependencies): Holepunch address utility; stable dependency for hyperdht. | ai | |
| dependencies | unvetted-dep:bogon | AI (dependencies): Known Holepunch ecosystem utility for IP classification; stable dependency. | ai | |
| dependencies | unvetted-dep:xache | AI (dependencies): Known Holepunch ecosystem cache library; stable dependency. | ai |
Versions (showing 8 of 8)
| Version | Deps | Published |
|---|---|---|
| 6.33.0 | 19 / 6 | |
| 6.32.0 | 19 / 6 | |
| 6.31.0 | 19 / 6 | |
| 6.30.0 | 19 / 6 | |
| 6.29.3 | 19 / 6 | |
| 6.28.0 | 19 / 6 | |
| 6.27.1 | 19 / 6 | |
| 6.25.2 | 19 / 5 |
v6.33.0
1 finding
INFO
Has SLSA provenance attestation
provenance
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.