@opentelemetry/otlp-proto-exporter-base Apache-2.0 34 versions

@opentelemetry/otlp-proto-exporter-base

npm Repository Homepage

OpenTelemetry OTLP-HTTP-protobuf Exporter base (for internal use only)

34

Versions

Apache-2.0

License

No

Install Scripts

Missing

Provenance

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.

Maintainers

pichlermarcbogdandrutudyladan

Keywords

opentelemetrynodejsprotobuftracingprofilingmetricsstats

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
phantom-deps	phantom-dep:@grpc/proto-loader	AI (phantom-deps): @grpc/proto-loader is declared for gRPC-based exporter consumers; indirect/conditional use in a base exporter package is expected.	ai	2026/04/24
source-diff	large-new-source-files	AI (source-diff): New files are pre-generated protobuf definitions (root.js + sourcemaps for ESM/ESNext). This is expected for an OTLP protobuf exporter package and stable for this package.	ai	2026/04/24
source-diff	source-size-tripled	AI (source-diff): Size increase is due to bundled generated protobuf files (root.js ~700KB x2 builds + sourcemaps). Legitimate and expected for this package's purpose.	ai	2026/04/24
publish-pattern	new-deps-added	AI (publish-pattern): The new dep (protobufjs) is the canonical protobuf library, directly aligned with this package's purpose as an OTLP protobuf exporter. Not a suspicious addition.	ai	2026/04/24
dependencies	unvetted-dep:protobufjs	AI (dependencies): protobufjs is the canonical JS protobuf library and a natural fit for an OTLP protobuf exporter package. Its use here is expected and legitimate.	ai	2026/04/24
provenance	publisher-changed	AI (provenance): pichlermarc is a well-established OpenTelemetry JS maintainer (1247 approved packages, 1073 days history). This is a legitimate project maintainer transition, not a compromise.	ai	2026/04/23
phantom-deps	phantom-dep:@opentelemetry/core	AI (phantom-deps): @opentelemetry/core is a legitimate same-org runtime dependency declared in package.json; phantom detection is a false positive for this monorepo package.	ai	2026/04/23
maintainer-change	maintainer-added	AI (maintainer-change): pichlermarc is a core OpenTelemetry JS contributor with extensive track record. Addition is a legitimate maintainer transition within the official project.	ai	2026/04/23

Versions (showing 34 of 34)

Version	Deps	Published
0.51.1	3 / 16	2024-05-07
0.51.0	3 / 16	2024-04-24
0.50.0	3 / 16	2024-04-03
0.49.1	3 / 16	2024-02-29
0.49.0	3 / 16	2024-02-29
0.48.0	3 / 16	2024-01-26
0.47.0	3 / 15	2024-01-15
0.46.0	3 / 15	2023-12-14
0.45.1	3 / 15	2023-11-08
0.45.0	3 / 15	2023-11-07
0.44.0	3 / 15	2023-10-10
0.43.0	3 / 15	2023-09-12
0.42.0	3 / 15	2023-09-11
0.41.2	3 / 15	2023-08-08
0.41.1	3 / 15	2023-07-24
0.41.0	4 / 15	2023-07-06
0.40.0	3 / 13	2023-06-06
0.39.1	3 / 13	2023-05-12
0.39.0	3 / 13	2023-05-11
0.38.0	3 / 14	2023-04-13
0.37.0	3 / 14	2023-03-30
0.36.1	3 / 14	2023-03-20
0.36.0	3 / 14	2023-03-13
0.35.1	3 / 14	2023-01-30
0.35.0	3 / 14	2023-01-11
0.34.0	3 / 14	2022-11-09
0.33.0	4 / 14	2022-09-16
0.32.0	3 / 14	2022-08-24
0.31.0	3 / 14	2022-07-26
0.30.0	4 / 14	2022-07-06
0.29.2	4 / 14	2022-06-06
0.29.1	4 / 14	2022-06-01
0.29.0	4 / 14	2022-05-27
0.28.0	4 / 14	2022-04-22

v0.51.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.51.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.50.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.49.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.49.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.48.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.47.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.46.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.45.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.45.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.44.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.43.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.42.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.41.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.41.1

2 findings

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: pichlermarc → dyladan (on 2023-07-24) provenance

[Accepted risk] This version was published by a different npm account than previous versions on 2023-07-24. This could indicate a legitimate maintainer transition or an account compromise.

v0.41.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.40.0

2 findings

HIGH Publisher changed: dyladan → pichlermarc (on 2023-06-06) provenance

This version was published by a different npm account than previous versions on 2023-06-06. This could indicate a legitimate maintainer transition or an account compromise.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.39.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.39.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.38.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.37.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.36.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.36.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.35.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.35.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.34.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.33.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.32.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.31.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.30.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.29.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.29.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.29.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.28.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.