@asyncapi/parser — Greenflagged

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures gitHead linked

Maintainers

fmvilasderbergasyncapi-bot

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
provenance	publisher-changed	AI (provenance): asyncapi/parser-js uses GitHub Actions CI for publishing; bot→GHA transition is expected and backed by SLSA attestation.	ai	2026/04/27
publish-pattern	dormant-publish	AI (publish-pattern): Established AsyncAPI org package with SLSA provenance; dormancy reflects release cadence, not account takeover.	ai	2026/04/27
phantom-deps	phantom-dep:avsc	AI (phantom-deps): avsc is a legitimate runtime dep for Avro schema parsing; phantom detection likely misses convention-based or indirect imports.	ai	2026/04/27
phantom-deps	phantom-dep:@types/json-schema	AI (phantom-deps): TypeScript type definition package loaded by convention; not directly imported at runtime by design.	ai	2026/04/27
phantom-deps	phantom-dep:@types/urijs	AI (phantom-deps): TypeScript type definition package loaded by convention; not directly imported at runtime by design.	ai	2026/04/27
phantom-deps	phantom-dep:js-yaml	AI (phantom-deps): js-yaml is a standard YAML parsing dep for an AsyncAPI parser; phantom detection likely misses indirect usage paths.	ai	2026/04/27
phantom-deps	phantom-dep:@openapi-contrib/openapi-schema-to-json-schema	AI (phantom-deps): Legitimate OpenAPI-to-JSON-Schema conversion dep; phantom detection likely misses config-driven or indirect imports.	ai	2026/04/27
dependencies	unvetted-dep:@stoplight/json	AI (dependencies): @stoplight/json is a well-known utility from Stoplight; legitimate dependency for JSON parsing/validation.	ai	2026/04/27
dependencies	unvetted-dep:@stoplight/types	AI (dependencies): @stoplight/types is a well-known types package from Stoplight; legitimate dependency.	ai	2026/04/27
dependencies	unvetted-dep:@stoplight/spectral-core	AI (dependencies): @stoplight/spectral-core is the core of the well-known Spectral linting framework; legitimate dependency for spec validation.	ai	2026/04/27
dependencies	unvetted-dep:@stoplight/json-ref-readers	AI (dependencies): Legitimate Stoplight package for JSON reference resolution; expected in a spec parser.	ai	2026/04/27
dependencies	unvetted-dep:@stoplight/spectral-parsers	AI (dependencies): Legitimate Stoplight Spectral package; expected dependency for spec parsing.	ai	2026/04/27
typosquat	typosquat.levenshtein:parcel	AI (typosquat): @asyncapi/parser is the official AsyncAPI spec parser under the @asyncapi org scope — not a typosquat of 'parcel'. Levenshtein match is a false positive; stable across all versions.	ai	2026/04/27
dependencies	unvetted-dep:@stoplight/spectral-functions	AI (dependencies): Legitimate Stoplight Spectral package; expected dependency for spec validation functions.	ai	2026/04/27
dependencies	unvetted-dep:@stoplight/spectral-ref-resolver	AI (dependencies): Legitimate Stoplight Spectral package; expected dependency for reference resolution.	ai	2026/04/27
dependencies	unvetted-dep:@openapi-contrib/openapi-schema-to-json-schema	AI (dependencies): Legitimate OpenAPI Contrib package for schema conversion; expected in an AsyncAPI parser that supports OpenAPI schemas.	ai	2026/04/27
dependencies	unvetted-dep:@stoplight/json-ref-resolver	AI (dependencies): Legitimate Stoplight package for JSON reference resolution; expected in a spec parser.	ai	2026/04/27
dependencies	unvetted-dep:@types/urijs	AI (dependencies): @types/urijs is a legitimate DefinitelyTyped package; expected TypeScript type dependency for this parser.	ai	2026/04/27
dependencies	unvetted-dep:@asyncapi/specs	AI (dependencies): @asyncapi/specs is the official AsyncAPI specification package from the same organization; core dependency for this parser.	ai	2026/04/27

Versions (showing 3 of 3)

Version	Deps	Published
3.6.0	19 / 27	2026-01-30
3.5.0	19 / 27	2026-01-30
3.4.0	19 / 27	2024-10-28

v3.6.0

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v3.5.0

2 findings

HIGH Publisher changed: asyncapi-bot → GitHub Actions (on 2026-01-30) provenance

This version was published by a different npm account than previous versions on 2026-01-30. This could indicate a legitimate maintainer transition or an account compromise.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v3.4.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.