← Home

@tootallnate/once

Creates a Promise that waits for a single event

7
Versions
MIT
License
No
Install Scripts
Verified
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures No source commit

Maintainers

tootallnate

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
provenance slsa-provenance AI (provenance): Package consistently published via GitHub Actions with SLSA attestation; this is the expected publish pattern for this package going forward. ai
provenance publisher-changed AI (provenance): Publisher changed to GitHub Actions CI, consistent with adoption of automated release workflow using @changesets/cli. SLSA attestation confirms integrity. ai
provenance missing-githead AI (provenance): gitHead absence is compensated by SLSA provenance attestation, which provides a stronger cryptographic link to the source commit. ai

Versions (showing 7 of 7)

Version Deps Published
3.0.1 0 / 8
3.0.0 0 / 7
2.0.0 0 / 7
1.1.2 0 / 13
1.1.1 0 / 13
1.1.0 0 / 13
1.0.0 0 / 13

v3.0.1

3 findings
HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: GitHub Actions.

HIGH Publisher changed: tootallnate → GitHub Actions (on 2026-02-09) provenance

This version was published by a different npm account than previous versions on 2026-02-09. This could indicate a legitimate maintainer transition or an account compromise.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v3.0.0

2 findings
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

LOW GHSA-vpq2-c234-7xj6: @tootallnate/once vulnerable to Incorrect Control Flow Scoping osv

CVSS 3.3 (LOW) — CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L Versions of the package @tootallnate/once before 3.0.1 are vulnerable to Incorrect Control Flow Scoping in promise resolving when AbortSignal option is used. The Promise remains in a permanently pending state after the signal is aborted, causing any await or .then() usage to hang indefinitely. This can cause a control-flow leak that can lead to stalled requests, blocked workers, or degraded application availability.

v2.0.0

2 findings
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

LOW GHSA-vpq2-c234-7xj6: @tootallnate/once vulnerable to Incorrect Control Flow Scoping osv

CVSS 3.3 (LOW) — CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L Versions of the package @tootallnate/once before 3.0.1 are vulnerable to Incorrect Control Flow Scoping in promise resolving when AbortSignal option is used. The Promise remains in a permanently pending state after the signal is aborted, causing any await or .then() usage to hang indefinitely. This can cause a control-flow leak that can lead to stalled requests, blocked workers, or degraded application availability.