@grpc/proto-loader Apache-2.0 22 versions

@grpc/proto-loader

npm Repository Homepage

gRPC utility library for loading .proto files

22

Versions

Apache-2.0

License

No

Install Scripts

Missing

Provenance

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.

Maintainers

murgatroid99grpc-packagesnicolasnoble

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
publish-pattern	new-deps-added	AI (publish-pattern): long, yargs, and @types/long are well-established packages added to support the new proto-loader-gen-types CLI binary. Consistent with documented feature addition.	ai	2026/04/23
source-diff	source-size-tripled	AI (source-diff): Size increase is explained by the addition of the proto-loader-gen-types code generation binary and associated type generation logic, a documented new feature in 0.7.0.	ai	2026/04/23
dependencies	unvetted-dep:@types/long	AI (dependencies): @types/long is the TypeScript type definitions for the 'long' library, a standard dependency in the gRPC/protobuf ecosystem. Stable accept for this package.	ai	2026/04/23
phantom-deps	phantom-dep:@types/long	AI (phantom-deps): @types/long provides TypeScript type augmentations used by the package's type generation tooling; not directly imported but legitimately declared as a dependency.	ai	2026/04/23
dependencies	unvetted-dep:protobufjs	AI (dependencies): protobufjs is the canonical protobuf library for Node.js and is an expected, legitimate dependency for a gRPC proto-loading utility published by Google.	ai	2026/04/21

Versions (showing 22 of 22)

Version	Deps	Published
0.8.1	4 / 11	2026-05-07
0.8.0	4 / 11	2025-07-21
0.7.15	4 / 11	2025-04-18
0.7.14	4 / 11	2025-04-17
0.7.13	4 / 11	2024-05-01
0.7.12	4 / 9	2024-03-28
0.7.11	4 / 9	2024-03-26
0.7.10	4 / 9	2023-09-18
0.7.9	4 / 9	2023-08-23
0.7.1	4 / 9	2022-08-17
0.7.0	5 / 9	2022-07-14
0.6.0	5 / 9	2021-04-06
0.5.6	2 / 7	2021-01-20
0.5.5	2 / 6	2020-07-10
0.5.4	2 / 5	2020-04-01
0.5.3	2 / 5	2019-11-04
0.5.2	2 / 5	2019-09-03
0.5.1	2 / 5	2019-05-17
0.5.0	2 / 5	2019-04-10
0.4.0	2 / 5	2019-01-17
0.3.0	4 / 3	2018-07-11
0.1.0	4 / 3	2018-04-30

v0.8.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.8.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.7.15

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.7.14

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.7.13

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.7.12

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.7.11

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.7.10

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.7.9

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.7.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.7.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.6.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.5.6

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.5.5

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.5.4

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.5.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.5.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.5.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.5.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.4.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.3.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.1.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.