openid-client
OAuth 2 / OpenID Connect Client API for JavaScript Runtimes
69
Versions
MIT
License
No
Install Scripts
Verified
Provenance
Supply chain provenance
Status for the latest visible version.
SLSA provenance attestation
npm registry signatures
gitHead linked
Maintainers
panva
Keywords
access tokenauthauthenticationauthorizationbasicbrowserbuncertifiedcibaclientcloudflaredenoedgeelectronfapijavascriptjwtnetlifynextnextjsnodenodejsoauthoauth2oidcopenid-connectopenidpassportstrategyvercelworkerdworkers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| provenance | publisher-changed | AI (provenance): Publisher changed from panva personal account to GitHub Actions CI/CD with SLSA provenance attestation. This is a standard, positive migration for panva's packages. | ai | |
| publish-pattern | dormant-publish | AI (publish-pattern): Mature package (218 versions, 8M downloads) by well-known maintainer panva. Dormancy gap is not indicative of compromise given SLSA provenance and consistent repo ownership. | ai | |
| source-diff | large-new-source-files | AI (source-diff): 23 new files is normal for a mature package evolution; no evidence of bundled/injected code in this well-established project. | ai | |
| publish-pattern | new-deps-added | AI (publish-pattern): jose is an established cryptographic library by the same author; adding it for OpenID Connect support is contextually appropriate and not a supply-chain attack vector. | ai | |
| semgrep | semgrep:base64-decode | AI (semgrep): Base64url decoding is a documented part of JWT/OIDC spec; standard utility function with no suspicious context. | ai | |
| provenance | no-provenance | AI (provenance): openid-client is a long-established, high-download package published well before Sigstore provenance was available on npm. No provenance is expected and not a risk signal here. | ai | |
| dependencies | unvetted-dep:oauth4webapi | AI (dependencies): oauth4webapi is a well-established OAuth library by the same author (panva); unvetted status is a registry artifact, not a real risk signal for this package. | ai | |
| dependencies | unvetted-dep:jose | AI (dependencies): jose is an established cryptographic library by panva; appropriate for OpenID Connect token handling. | ai |
Versions (showing 69 of 69)
| Version | Deps | Published |
|---|---|---|
| 6.8.4 | 2 / 30 | |
| 6.8.3 | 2 / 30 | |
| 6.8.2 | 2 / 29 | |
| 6.8.1 | 2 / 29 | |
| 6.8.0 | 2 / 29 | |
| 6.7.1 | 2 / 29 | |
| 6.7.0 | 2 / 29 | |
| 6.6.4 | 2 / 29 | |
| 6.6.3 | 2 / 29 | |
| 6.6.2 | 2 / 29 | |
| 6.6.1 | 2 / 29 | |
| 6.6.0 | 2 / 29 | |
| 6.5.3 | 2 / 28 | |
| 6.5.2 | 2 / 28 | |
| 6.5.1 | 2 / 28 | |
| 6.5.0 | 2 / 28 | |
| 6.4.2 | 2 / 28 | |
| 6.4.1 | 2 / 29 | |
| 6.4.0 | 2 / 29 | |
| 6.3.4 | 2 / 29 | |
| 6.3.3 | 2 / 29 | |
| 6.3.2 | 2 / 29 | |
| 6.3.1 | 2 / 29 | |
| 6.3.0 | 2 / 29 | |
| 6.2.0 | 2 / 29 | |
| 6.1.7 | 2 / 29 | |
| 6.1.6 | 2 / 29 | |
| 6.1.5 | 2 / 29 | |
| 6.1.4 | 2 / 29 | |
| 6.1.3 | 2 / 29 | |
| 6.1.2 | 2 / 29 | |
| 6.1.1 | 2 / 29 | |
| 6.1.0 | 2 / 29 | |
| 6.0.0 | 2 / 29 | |
| 5.7.1 | 4 / 10 | |
| 5.7.0 | 4 / 10 | |
| 5.6.5 | 4 / 10 | |
| 5.6.4 | 4 / 10 | |
| 5.6.3 | 4 / 10 | |
| 5.6.2 | 4 / 10 | |
| 5.6.1 | 4 / 10 | |
| 5.6.0 | 4 / 10 | |
| 5.5.0 | 4 / 11 | |
| 5.4.3 | 4 / 11 | |
| 5.4.2 | 4 / 11 | |
| 5.4.1 | 4 / 11 | |
| 5.4.0 | 4 / 11 | |
| 5.3.4 | 4 / 11 | |
| 5.3.3 | 4 / 11 | |
| 5.3.2 | 4 / 11 | |
| 5.3.1 | 4 / 11 | |
| 5.3.0 | 4 / 11 | |
| 5.2.1 | 4 / 11 | |
| 5.2.0 | 4 / 11 | |
| 5.1.10 | 4 / 12 | |
| 5.1.9 | 4 / 12 | |
| 5.1.8 | 4 / 12 | |
| 5.1.7 | 4 / 12 | |
| 5.1.6 | 4 / 12 | |
| 5.1.5 | 4 / 12 | |
| 5.1.4 | 4 / 12 | |
| 5.1.3 | 4 / 12 | |
| 5.1.2 | 4 / 12 | |
| 5.1.1 | 4 / 12 | |
| 5.1.0 | 4 / 12 | |
| 5.0.2 | 4 / 12 | |
| 5.0.1 | 4 / 12 | |
| 5.0.0 | 4 / 12 | |
| 2.5.0 | 8 / 14 |