@ipld/dag-json — Greenflagged

JS implementation of DAG-JSON

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures gitHead linked

Maintainers

daviddiasmikealvmxalanshawachingbrainvascosantosrvagglidelnpm-service-account-ipld

Keywords

ipfsipldmultiformats

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
semgrep	semgrep:base64-decode	AI (semgrep): Base64 decoding is a core feature of the DAG-JSON spec for encoding binary blobs; this is expected codec behavior, not a malicious payload.	ai	2026/04/24
publish-pattern	new-deps-added	AI (publish-pattern): cborg and multiformats are core IPLD ecosystem packages replacing older deps in a legitimate major-version refactor; not a supply-chain risk for this package.	ai	2026/04/24
source-diff	source-size-tripled	AI (source-diff): Size increase explained by major version bump adding TypeScript types, dual CJS/ESM output, and browser support — consistent with the build script and exports changes in package.json.	ai	2026/04/24
maintainer-change	maintainer-added	AI (maintainer-change): New maintainers (lidel, alanshaw, vascosantos, achingbrain) are all known IPFS/IPLD ecosystem contributors; this reflects a legitimate team expansion.	ai	2026/04/24
provenance	publisher-changed	AI (provenance): Publisher change from mikeal to rvagg is a documented legitimate maintainer transition in the IPLD ecosystem; rvagg is a well-known contributor with strong track record.	ai	2026/04/24
provenance	no-provenance	AI (provenance): Package predates Sigstore provenance attestation; absence is expected for packages of this age and does not indicate risk.	ai	2026/04/24
dependencies	unvetted-dep:lodash.transform	AI (dependencies): lodash.transform is a well-known, stable lodash utility with a long track record; its use as a runtime dependency here is legitimate and low-risk.	ai	2026/04/24
dependencies	unvetted-dep:cborg	AI (dependencies): cborg is a well-known CBOR codec maintained by the same IPLD/IPFS ecosystem author (Rod Vagg); its use here is expected and legitimate for a DAG-JSON codec implementation.	ai	2026/04/21

Versions (showing 51 of 61)

View all versions

Version	Deps	Published
11.0.0	2 / 2	2026-05-12
10.2.9	2 / 2	2026-05-12
10.2.8	2 / 2	2026-05-12
10.2.7	2 / 2	2026-04-02
10.2.6	2 / 2	2026-01-19
10.2.5	2 / 2	2025-05-22
10.2.4	2 / 2	2025-05-08
10.2.3	2 / 2	2024-10-29
10.2.2	2 / 2	2024-06-24
10.2.1	2 / 2	2024-06-01
10.2.0	2 / 2	2024-02-16
10.1.7	2 / 2	2024-01-10
10.1.6	2 / 2	2023-12-30
10.1.5	2 / 2	2023-10-03
10.1.4	2 / 2	2023-09-12
10.1.3	2 / 2	2023-08-08
10.1.2	2 / 2	2023-06-19
10.1.1	2 / 2	2023-06-14
10.1.0	2 / 2	2023-05-23
10.0.1	2 / 2	2023-02-08
10.0.0	2 / 2	2023-01-06
9.1.1	2 / 2	2023-01-03
9.1.0	2 / 2	2022-12-19
9.0.1	2 / 2	2022-10-24
9.0.0	2 / 2	2022-10-19
8.0.11	2 / 8	2022-08-27
8.0.10	2 / 8	2022-05-25
8.0.9	2 / 8	2022-04-05
8.0.8	2 / 8	2022-03-02
8.0.7	2 / 8	2021-12-10
8.0.6	2 / 8	2021-12-09
8.0.5	2 / 8	2021-12-09
8.0.1	2 / 8	2021-09-28
6.0.0	2 / 8	2021-05-19
3.0.14	3 / 6	2020-08-19
3.0.13	3 / 6	2020-08-18
3.0.12	3 / 6	2020-07-19
3.0.11	3 / 6	2020-06-24
3.0.10	3 / 6	2020-06-24
3.0.9	3 / 6	2020-06-24
3.0.8	3 / 6	2020-06-20
3.0.7	3 / 6	2020-06-20
3.0.6	3 / 6	2020-06-20
3.0.5	3 / 5	2020-06-18
3.0.4	3 / 5	2020-06-18
3.0.3	3 / 5	2020-06-18
3.0.2	3 / 5	2020-06-12
3.0.1	3 / 5	2020-06-12
3.0.0	3 / 5	2020-06-11
2.0.10	5 / 3	2020-05-12
2.0.9	5 / 3	2020-03-09

v11.0.0

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v10.2.9

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v10.2.8

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v10.2.6

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v10.2.5

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v10.2.4

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v10.2.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v10.2.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v10.2.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v10.2.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v10.1.7

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v10.1.6

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v10.1.5

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v10.1.4

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v10.1.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v10.1.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v10.1.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v10.1.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v10.0.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v10.0.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v9.1.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v9.1.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v9.0.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v9.0.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v8.0.11

2 findings

HIGH Publisher changed: mikeal → npm-service-account-ipld (on 2022-08-27) provenance

This version was published by a different npm account than previous versions on 2022-08-27. This could indicate a legitimate maintainer transition or an account compromise.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v8.0.10

2 findings

HIGH Publisher changed: mikeal → rvagg (on 2022-05-25) provenance

This version was published by a different npm account than previous versions on 2022-05-25. This could indicate a legitimate maintainer transition or an account compromise.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v8.0.9

2 findings

HIGH Publisher changed: mikeal → rvagg (on 2022-04-05) provenance

This version was published by a different npm account than previous versions on 2022-04-05. This could indicate a legitimate maintainer transition or an account compromise.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v8.0.8

2 findings

HIGH Publisher changed: mikeal → rvagg (on 2022-03-02) provenance

This version was published by a different npm account than previous versions on 2022-03-02. This could indicate a legitimate maintainer transition or an account compromise.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v8.0.7

2 findings

HIGH Publisher changed: mikeal → rvagg (on 2021-12-10) provenance

This version was published by a different npm account than previous versions on 2021-12-10. This could indicate a legitimate maintainer transition or an account compromise.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v8.0.6

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v8.0.5

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v8.0.1

2 findings

HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: mikeal.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.0.0

2 findings

HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: mikeal.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.0.14

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.0.13

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.0.12

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.0.11

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.0.10

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.0.9

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.0.8

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.0.7

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.0.6

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.0.5

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v3.0.4

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.0.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v3.0.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v3.0.1

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.0.0

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.0.10

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.0.9

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.