← Home

n8n-core

npm Repository Homepage
74
Versions
—
License
No
Install Scripts
Verified
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures No source commit

Maintainers

jan_n8n_ion8n-matsuuucornelius_n8n_iotomin8n

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
publish-pattern new-deps-added AI (publish-pattern): New deps are well-known (@azure, @sentry, @n8n/*), consistent with active n8n development. ai
phantom-deps phantom-dep:qs AI (phantom-deps): Monorepo build artifact; qs likely used indirectly, no malicious behavior found. ai
phantom-deps phantom-dep:form-data AI (phantom-deps): form-data is a declared dependency used indirectly; stable false positive for this package. ai
provenance publisher-changed AI (provenance): tomin8n is an established n8n org publisher with 180 approved packages; transition from jan_n8n_io is a documented org account change. ai
maintainer-change maintainer-added AI (maintainer-change): Same org transition; tomin8n has strong track record across n8n packages. ai
publish-pattern dormant-publish AI (publish-pattern): Dormancy reflects the publisher account change, not actual project inactivity; n8n-core is actively maintained. ai
phantom-deps phantom-dep:xml2js AI (phantom-deps): Declared in package.json deps; phantom-dep heuristic false positive for this package. ai
phantom-deps phantom-dep:callsites AI (phantom-deps): Declared in package.json deps; phantom-dep heuristic false positive for this package. ai
phantom-deps phantom-dep:winston AI (phantom-deps): Declared in package.json deps; phantom-dep heuristic false positive for this package. ai
phantom-deps phantom-dep:picocolors AI (phantom-deps): Declared in package.json deps; phantom-dep heuristic false positive for this package. ai
phantom-deps phantom-dep:htmlparser2 AI (phantom-deps): Declared in package.json deps; phantom-dep heuristic false positive for this package. ai
phantom-deps phantom-dep:@n8n/workflow-sdk AI (phantom-deps): Declared in package.json deps; phantom-dep heuristic false positive for this package. ai

Versions (showing 74 of 174)

Version Deps Published
2.4.4 38 / 9
2.4.3 38 / 9
2.4.2 38 / 9
2.4.1 38 / 9
2.4.0 38 / 9
2.3.4 38 / 9
2.3.3 38 / 9
2.3.2 38 / 9
2.3.1 38 / 9
2.3.0 38 / 9
2.2.3 38 / 9
2.2.2 38 / 9
2.2.1 38 / 9
2.2.0 38 / 9
2.1.4 38 / 9
2.1.3 38 / 9
2.1.2 38 / 9
2.1.1 38 / 9
2.1.0 38 / 9
2.0.2 38 / 9
2.0.1 38 / 9
2.0.0 38 / 9
1.122.38 38 / 9
1.122.37 38 / 9
1.122.36 38 / 9
1.122.35 38 / 9
1.122.34 38 / 9
1.122.33 38 / 9
1.122.32 38 / 9
1.122.31 38 / 9
1.122.30 38 / 9
1.122.29 38 / 9
1.122.28 38 / 9
1.122.27 38 / 9
1.122.26 38 / 9
1.122.25 38 / 9
1.122.24 38 / 9
1.122.23 38 / 9
1.122.22 38 / 9
1.122.21 38 / 9
1.122.20 38 / 9
1.122.19 38 / 9
1.122.18 38 / 9
1.122.17 38 / 9
1.122.16 38 / 9
1.122.15 38 / 9
1.122.14 38 / 9
1.122.13 38 / 9
1.122.12 38 / 9
1.122.11 38 / 9
1.122.10 38 / 9
1.122.9 38 / 9
1.122.8 38 / 9
1.122.7 38 / 9
1.122.6 38 / 9
1.122.5 38 / 9
1.122.4 38 / 9
1.122.3 38 / 9
1.122.2 38 / 9
1.122.1 38 / 9
1.122.0 38 / 9
1.121.2 38 / 9
1.121.1 38 / 9
1.121.0 38 / 9
1.120.2 38 / 9
1.120.1 38 / 9
1.120.0 38 / 9
1.119.3 38 / 9
1.119.2 38 / 9
1.119.1 38 / 9
1.119.0 38 / 9
1.118.1 38 / 9
1.118.0 38 / 9
1.117.1 38 / 9

v1.122.38

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.122.37

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.122.36

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.