@pnpm/fetching.fetcher-base No license 11 versions

@pnpm/fetching.fetcher-base

npm Repository Homepage

11

Versions

—

License

No

Install Scripts

Verified

Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures No source commit

Maintainers

pnpmuserzkochan

Keywords

pnpmpnpm11fetcher

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
phantom-deps	phantom-dep:@types/ssri	AI (phantom-deps): @types/ssri is a TypeScript type declaration package used for type-checking; declaring it as a dependency without direct runtime import is a standard pattern in TypeScript packages.	ai	2026/04/25
dependencies	unvetted-dep:@pnpm/resolving.resolver-base	AI (dependencies): @pnpm/resolving.resolver-base is an internal pnpm monorepo package published by the same trusted pnpmuser publisher; not a supply chain risk.	ai	2026/04/25

Versions (showing 11 of 11)

Version	Deps	Published
1100.1.6	3 / 2	2026-05-27
1100.1.5	3 / 2	2026-05-20
1100.1.4	3 / 2	2026-05-18
1100.1.3	3 / 2	2026-05-11
1100.1.2	3 / 2	2026-05-06
1100.1.1	3 / 2	2026-04-30
1100.1.0	3 / 2	2026-04-21
1100.0.2	3 / 2	2026-04-20
1100.0.1	3 / 2	2026-04-15
1100.0.0	3 / 2	2026-04-10
1001.0.2	3 / 2	2026-03-19

v1100.1.6

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1100.1.5

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1100.1.4

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1100.1.3

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1100.1.2

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1100.1.1

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1100.1.0

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1100.0.2

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1100.0.1

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1100.0.0

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1001.0.2

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.