libnpmpack
Programmatic API for the bits behind npm pack
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| provenance | missing-githead | AI (provenance): libnpmpack is an npm CLI workspace package published by the npm team (gar). Missing gitHead reflects a CI/CD pipeline change, not a security concern, consistent across npm CLI workspace packages. | ai | |
| publish-pattern | new-deps-added | AI (publish-pattern): @npmcli/arborist is a first-party npm CLI team package; its addition to libnpmpack is functionally appropriate and not a suspicious third-party dependency. | ai | |
| maintainer-change | maintainer-takeover | AI (maintainer-change): Transition from claudiahdz to the npm CLI team at GitHub (fritzy, darcyclarke, nlf, gar, lukekarrys) is a documented, legitimate org-level maintainer change for official npm tooling packages. | ai | |
| provenance | publisher-changed | AI (provenance): Publisher change reflects the npm team transition at GitHub; fritzy is a known npm CLI team member publishing official npm workspace packages. | ai | |
| maintainer-change | maintainer-added | AI (maintainer-change): New maintainers are all known npm CLI team members at GitHub; addition is consistent with org-level team management of official npm packages. | ai | |
| dependencies | unvetted-dep:move-concurrently | AI (dependencies): move-concurrently is a standard file-move utility used throughout npm tooling; no security concerns for this npm official package. | ai | |
| dependencies | unvetted-dep:byte-size | AI (dependencies): byte-size is a well-known, widely-used byte formatting utility with no security concerns; stable false positive for this npm official package. | ai | |
| maintainer-change | maintainer-removed | AI (maintainer-change): gar and hashtagchris are former npm employees; removal reflects normal org personnel changes for this long-lived npm/GitHub org package. | ai | |
| dependencies | unvetted-dep:pacote | AI (dependencies): pacote is a core npm CLI dependency maintained by the npm/GitHub org; unvetted status reflects coverage gap, not real risk. | ai | |
| dependencies | unvetted-dep:@npmcli/arborist | AI (dependencies): @npmcli/arborist is a core npm CLI dependency maintained by the npm/GitHub org; unvetted status reflects coverage gap, not real risk. | ai | |
| dependencies | unvetted-dep:@npmcli/run-script | AI (dependencies): @npmcli/run-script is a core npm CLI dependency maintained by the npm/GitHub org; unvetted status reflects coverage gap, not real risk. | ai | |
| provenance | no-provenance | AI (provenance): libnpmpack is an official npm CLI workspace package; lack of Sigstore provenance is common and not a risk indicator for this well-known package. | ai |
Versions (showing 51 of 85)
| Version | Deps | Published |
|---|---|---|
| 10.0.1 | 4 / 5 | |
| 10.0.0 | 4 / 5 | |
| 9.1.11 | 4 / 5 | |
| 9.1.10 | 4 / 5 | |
| 9.1.9 | 4 / 5 | |
| 9.1.8 | 4 / 5 | |
| 9.1.7 | 4 / 5 | |
| 9.1.6 | 4 / 5 | |
| 9.1.5 | 4 / 5 | |
| 9.1.4 | 4 / 5 | |
| 9.1.3 | 4 / 5 | |
| 9.1.2 | 4 / 5 | |
| 9.1.1 | 4 / 5 | |
| 9.1.0 | 4 / 5 | |
| 9.0.13 | 4 / 5 | |
| 9.0.12 | 4 / 5 | |
| 9.0.11 | 4 / 5 | |
| 9.0.10 | 4 / 5 | |
| 9.0.9 | 4 / 5 | |
| 9.0.8 | 4 / 5 | |
| 9.0.7 | 4 / 5 | |
| 9.0.6 | 4 / 5 | |
| 9.0.5 | 4 / 5 | |
| 9.0.4 | 4 / 5 | |
| 9.0.3 | 4 / 5 | |
| 9.0.2 | 4 / 5 | |
| 9.0.1 | 4 / 5 | |
| 9.0.0 | 4 / 5 | |
| 8.0.5 | 4 / 5 | |
| 8.0.4 | 4 / 5 | |
| 8.0.3 | 4 / 5 | |
| 8.0.2 | 4 / 5 | |
| 8.0.1 | 4 / 5 | |
| 8.0.0 | 4 / 5 | |
| 7.0.4 | 4 / 5 | |
| 7.0.3 | 4 / 5 | |
| 7.0.2 | 4 / 5 | |
| 7.0.1 | 4 / 5 | |
| 7.0.0 | 4 / 5 | |
| 6.0.9 | 4 / 5 | |
| 6.0.8 | 4 / 5 | |
| 6.0.7 | 4 / 5 | |
| 6.0.6 | 4 / 5 | |
| 6.0.5 | 4 / 5 | |
| 6.0.4 | 4 / 5 | |
| 6.0.3 | 4 / 5 | |
| 6.0.2 | 4 / 5 | |
| 6.0.1 | 4 / 5 | |
| 6.0.0 | 4 / 5 | |
| 5.0.21 | 4 / 5 | |
| 5.0.20 | 4 / 5 |
v10.0.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v10.0.0
2 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (reggi) than the most recent previously approved version (owlstronaut) on 2026-07-08, but reggi is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v9.1.11
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.