koa-json
pretty (non-compressed) json response middleware
9
Versions
MIT
License
No
Install Scripts
Missing
Provenance
Supply chain provenance
Status for the latest visible version.
No SLSA provenance
npm registry signatures
gitHead linked
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
aheckmanncoderhaoxindead_horseeivifjfengmk2jonathanongjongleberryjuliangrubertjholowaychuk
Keywords
koajson
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| provenance | publisher-changed | AI (provenance): Legitimate maintainer transition within the Koa ecosystem from jongleberry to coderhaoxin in 2016; both are known Koa contributors. | ai | |
| maintainer-change | maintainer-added | AI (maintainer-change): aheckmann and coderhaoxin are established npm maintainers added as part of the Koa ecosystem's normal governance. | ai | |
| provenance | no-provenance | AI (provenance): Package predates Sigstore provenance; published in 2016 when provenance attestations did not exist. | ai | |
| dependencies | unvetted-dep:koa-is-json | AI (dependencies): koa-is-json is a legitimate koajs ecosystem companion package; this dependency is stable and expected for koa-json across all versions. | ai | |
| publish-pattern | rapid-publish | AI (publish-pattern): Rapid publish is a false positive for this mature, trusted package with a strong publisher track record and no material code changes. | ai |