jwt-decode
Decode JWT tokens, mostly useful for browser applications.
3
Versions
MIT
License
No
Install Scripts
Missing
Provenance
Supply chain provenance
Status for the latest visible version.
No SLSA provenance
npm registry signatures
gitHead linked
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
ncluervic-devenriquepinaece-oktapubaloktadougmiller-oktazak.noursthellerjamescgarrett-oktamadhuri.rm23willvedddavid.renaud.oktajeff.shumanauth0-osscodepeteziluvatariacococojoeauth0npmauth0brokkrhzalazaaguiarzcharlesrealbalmacedajulien.wollscheidcristiandoucesambegostevehobbsdevsandrinodimattialzychowskijoshcanhelprob.colesrosnovskydavidpatrick0widcketadamjmcgrathjim.andersoonfrederikprijcksergii.biienkotomauth0jpadillajesselerhamzeh_auth0greglopezjfromanielloheyitsry
Keywords
jwtbrowser
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| provenance | publisher-changed | AI (provenance): Publisher changed from individual Auth0 employee (sambego/Sam Bellen) to Auth0's official OSS account (auth0-oss). Repository is auth0/jwt-decode on GitHub. Legitimate organizational transition. | ai | |
| maintainer-change | maintainer-added | AI (maintainer-change): New maintainers are Auth0/Okta-affiliated accounts consistent with corporate acquisition transition. auth0-oss is the official Auth0 OSS npm account. | ai | |
| maintainer-change | maintainer-removed | AI (maintainer-change): Removed maintainers are former Auth0 employees replaced by Okta-era Auth0 team. Consistent with organizational restructuring post-Okta acquisition. | ai | |
| publish-pattern | dormant-publish | AI (publish-pattern): Long gap between v3.1.2 and v4.0.0 reflects a major version rewrite (ESM/CJS dual exports, TypeScript modernization) by Auth0's official OSS account. Not indicative of takeover. | ai |