subscriptions-transport-ws
A websocket transport for GraphQL subscriptions
49
Versions
MIT
License
No
Install Scripts
Missing
Provenance
Supply chain provenance
Status for the latest visible version.
No SLSA provenance
npm registry signatures
gitHead linked
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
apollo-bot
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| provenance | missing-githead | AI (provenance): Established Apollo ecosystem package with 40+ approved versions; missing gitHead alone is insufficient signal given clean diff, trusted publisher history, and no other risk indicators. | ai | |
| phantom-deps | phantom-dep:@types/node | AI (phantom-deps): @types/node is a TypeScript type definition package; it is consumed by the TypeScript compiler, not imported directly in source code. Expected pattern for TS projects. | ai | |
| source-diff | obfuscated-file:coverage/lcov-report/prettify.js | AI (source-diff): This is the standard Google Code Prettify JS bundled by Istanbul in lcov HTML coverage reports. Minified by design; not malicious. Stable false positive for this package. | ai | |
| provenance | publisher-changed | AI (provenance): Publisher change (danielr → mxstbr) in 2018 reflects documented Apollo team transition; mxstbr is a well-known Apollo ecosystem contributor with strong track record. | ai | |
| maintainer-change | maintainer-added | AI (maintainer-change): jbaxleyiii and mxstbr are well-known Apollo/GraphQL ecosystem maintainers; addition in 2018 reflects legitimate project stewardship transfer. | ai | |
| email-domain | unclaimed-email:stubailo.com | AI (email-domain): Domain belongs to Sasha Stubailo, a well-known Apollo/GraphQL contributor. Package is 3500+ days old with strong ecosystem trust; risk of domain hijack affecting this established package is low. | ai | |
| install-scripts | install-script:postinstall | AI (install-scripts): Postinstall runs standard TypeScript compilation (node scripts/post-install.js); legitimate build step for this package type. | ai | |
| semgrep | semgrep:child-process-import | AI (semgrep): child_process import in postinstall is expected for build setup; script is auditable in public repo. | ai | |
| phantom-deps | phantom-dep:graphql-tag | AI (phantom-deps): graphql-tag is properly declared as a runtime dependency and used in the package; phantom-dep rule is a false positive. | ai | |
| phantom-deps | phantom-dep:@types/ws | AI (phantom-deps): @types/ws is a TypeScript type definition package; phantom-dep detection is a stable false positive for TypeScript projects. | ai | |
| phantom-deps | phantom-dep:lodash.assign | AI (phantom-deps): lodash.assign is declared and used; phantom-dep finding is a false positive for this package. | ai | |
| phantom-deps | phantom-dep:es6-promise | AI (phantom-deps): es6-promise is referenced in config/example files but not directly imported in main code. Benign packaging issue for this package. | ai | |
| phantom-deps | phantom-dep:node-static | AI (phantom-deps): node-static is used only in example/test config, not in the main runtime code. Phantom dep finding is a packaging hygiene issue, not a security risk for this package. | ai | |
| provenance | no-provenance | AI (provenance): Package predates Sigstore provenance by years; absence is expected and not a risk signal for this established package. | ai | |
| dependencies | unvetted-dep:backo2 | AI (dependencies): backo2 is a well-known, minimal exponential backoff utility; a stable, benign dependency for this package across all versions. | ai |
Versions (showing 49 of 49)
| Version | Deps | Published |
|---|---|---|
| 0.11.0 | 5 / 20 | |
| 0.10.0 | 5 / 21 | |
| 0.9.19 | 5 / 21 | |
| 0.9.17 | 5 / 21 | |
| 0.9.16 | 5 / 21 | |
| 0.9.15 | 5 / 21 | |
| 0.9.14 | 5 / 21 | |
| 0.9.13 | 5 / 21 | |
| 0.9.12 | 5 / 21 | |
| 0.9.11 | 8 / 21 | |
| 0.9.10 | 8 / 20 | |
| 0.9.9 | 8 / 20 | |
| 0.9.8 | 8 / 20 | |
| 0.9.7 | 8 / 20 | |
| 0.9.6 | 8 / 20 | |
| 0.9.5 | 8 / 20 | |
| 0.9.4 | 9 / 20 | |
| 0.9.3 | 9 / 20 | |
| 0.9.2 | 9 / 20 | |
| 0.8.1 | 9 / 18 | |
| 0.8.0 | 9 / 18 | |
| 0.7.3 | 10 / 16 | |
| 0.7.2 | 10 / 16 | |
| 0.7.1 | 10 / 16 | |
| 0.7.0 | 10 / 16 | |
| 0.6.0 | 9 / 15 | |
| 0.5.5 | 9 / 16 | |
| 0.5.4 | 8 / 17 | |
| 0.5.3 | 8 / 17 | |
| 0.5.2 | 8 / 17 | |
| 0.5.1 | 8 / 15 | |
| 0.5.0 | 8 / 15 | |
| 0.4.0 | 5 / 16 | |
| 0.3.1 | 5 / 16 | |
| 0.3.0 | 5 / 16 | |
| 0.2.6 | 8 / 24 | |
| 0.2.5 | 7 / 24 | |
| 0.2.4 | 7 / 22 | |
| 0.2.3 | 7 / 22 | |
| 0.2.2 | 5 / 17 | |
| 0.2.1 | 5 / 16 | |
| 0.2.0 | 6 / 16 | |
| 0.1.6 | 6 / 16 | |
| 0.1.5 | 6 / 16 | |
| 0.1.4 | 5 / 16 | |
| 0.1.3 | 5 / 16 | |
| 0.1.2 | 5 / 16 | |
| 0.1.1 | 5 / 16 | |
| 0.1.0 | 5 / 16 |