peerbit
Peerbit client
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| publish-pattern | new-deps-added | AI (publish-pattern): Added dep is first-party @peerbit/* package, consistent with monorepo structure. | ai | |
| dependencies | unvetted-dep:@sqlite.org/sqlite-wasm | AI (dependencies): Official SQLite WASM package from sqlite.org; expected dependency for browser-side indexer in this p2p database client. | ai | |
| provenance | no-provenance | AI (provenance): Established package; no provenance is consistent across all prior versions. | ai | |
| phantom-deps | phantom-dep:@peerbit/time | AI (phantom-deps): Own-ecosystem dep; phantom-dep heuristic false positive. | ai | |
| phantom-deps | phantom-dep:@dao-xyz/borsh | AI (phantom-deps): Own-ecosystem dep; phantom-dep heuristic false positive. | ai | |
| phantom-deps | phantom-dep:@peerbit/build-assets | AI (phantom-deps): Build tooling dep; phantom-dep heuristic false positive. | ai | |
| phantom-deps | phantom-dep:level | AI (phantom-deps): level is a peer/optional runtime dep re-exported by datastore-level; not directly imported but legitimately declared. | ai | |
| phantom-deps | phantom-dep:@peerbit/indexer-simple | AI (phantom-deps): Own-ecosystem dep; phantom-dep heuristic false positive. | ai | |
| phantom-deps | phantom-dep:@sqlite.org/sqlite-wasm | AI (phantom-deps): Platform-specific WASM binary; phantom-dep heuristic false positive. | ai | |
| phantom-deps | phantom-dep:@peerbit/stream-interface | AI (phantom-deps): Own-ecosystem dep; phantom-dep heuristic false positive. | ai | |
| phantom-deps | phantom-dep:@peerbit/any-store-opfs | AI (phantom-deps): Browser-specific dep; phantom-dep heuristic false positive. | ai | |
| phantom-deps | phantom-dep:p-queue | AI (phantom-deps): Utility dep used transitively; phantom-dep heuristic false positive for this package. | ai | |
| phantom-deps | phantom-dep:memory-level | AI (phantom-deps): Peer/optional dep for in-memory storage; stable false positive for this package. | ai |
Versions (showing 51 of 68)
| Version | Deps | Published |
|---|---|---|
| 5.3.12 | 37 / 5 | |
| 5.3.11 | 37 / 5 | |
| 5.3.10 | 37 / 5 | |
| 5.3.9 | 37 / 5 | |
| 5.3.8 | 37 / 5 | |
| 5.3.7 | 37 / 5 | |
| 5.3.6 | 36 / 5 | |
| 5.3.5 | 36 / 5 | |
| 5.3.4 | 36 / 5 | |
| 5.3.3 | 36 / 5 | |
| 5.3.2 | 36 / 5 | |
| 5.3.1 | 36 / 5 | |
| 5.3.0 | 36 / 5 | |
| 5.2.20 | 35 / 5 | |
| 5.2.19 | 35 / 5 | |
| 5.2.18 | 35 / 5 | |
| 5.2.17 | 35 / 5 | |
| 5.2.16 | 35 / 5 | |
| 5.2.15 | 35 / 5 | |
| 5.2.14 | 35 / 5 | |
| 5.2.13 | 35 / 5 | |
| 5.2.12 | 35 / 5 | |
| 5.2.11 | 35 / 5 | |
| 5.2.10 | 35 / 5 | |
| 5.2.9 | 35 / 5 | |
| 5.2.8 | 35 / 5 | |
| 5.2.7 | 35 / 5 | |
| 5.2.6 | 35 / 5 | |
| 5.2.5 | 35 / 5 | |
| 5.2.4 | 35 / 5 | |
| 5.2.3 | 35 / 5 | |
| 5.2.2 | 35 / 5 | |
| 5.2.1 | 35 / 5 | |
| 5.2.0 | 35 / 5 | |
| 5.1.2 | 35 / 5 | |
| 5.1.1 | 35 / 5 | |
| 5.1.0 | 35 / 5 | |
| 5.0.11 | 35 / 5 | |
| 5.0.10 | 35 / 5 | |
| 5.0.9 | 35 / 5 | |
| 5.0.8 | 35 / 5 | |
| 5.0.7 | 35 / 5 | |
| 5.0.6 | 35 / 5 | |
| 5.0.5 | 35 / 5 | |
| 5.0.4 | 35 / 5 | |
| 5.0.3 | 35 / 5 | |
| 5.0.2 | 35 / 5 | |
| 5.0.0 | 35 / 5 | |
| 4.4.19 | 35 / 5 | |
| 4.4.18 | 35 / 5 | |
| 4.4.17 | 35 / 5 |
v5.3.12
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.3.11
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.3.10
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.3.9
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.3.8
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.3.7
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.3.6
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.3.5
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.3.4
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.3.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.3.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.3.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.3.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.