@tootallnate/once
Creates a Promise that waits for a single event
Supply chain provenance
Status for the latest visible version.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| provenance | slsa-provenance | AI (provenance): Package consistently published via GitHub Actions with SLSA attestation; this is the expected publish pattern for this package going forward. | ai | |
| provenance | publisher-changed | AI (provenance): Publisher changed to GitHub Actions CI, consistent with adoption of automated release workflow using @changesets/cli. SLSA attestation confirms integrity. | ai | |
| provenance | missing-githead | AI (provenance): gitHead absence is compensated by SLSA provenance attestation, which provides a stronger cryptographic link to the source commit. | ai |
Versions (showing 7 of 7)
| Version | Deps | Published |
|---|---|---|
| 3.0.1 | 0 / 8 | |
| 3.0.0 | 0 / 7 | |
| 2.0.0 | 0 / 7 | |
| 1.1.2 | 0 / 13 | |
| 1.1.1 | 0 / 13 | |
| 1.1.0 | 0 / 13 | |
| 1.0.0 | 0 / 13 |
v3.0.1
3 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: GitHub Actions.
This version was published by a different npm account than previous versions on 2026-02-09. This could indicate a legitimate maintainer transition or an account compromise.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v3.0.0
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
CVSS 3.3 (LOW) — CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L Versions of the package @tootallnate/once before 3.0.1 are vulnerable to Incorrect Control Flow Scoping in promise resolving when AbortSignal option is used. The Promise remains in a permanently pending state after the signal is aborted, causing any await or .then() usage to hang indefinitely. This can cause a control-flow leak that can lead to stalled requests, blocked workers, or degraded application availability.
v2.0.0
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
CVSS 3.3 (LOW) — CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L Versions of the package @tootallnate/once before 3.0.1 are vulnerable to Incorrect Control Flow Scoping in promise resolving when AbortSignal option is used. The Promise remains in a permanently pending state after the signal is aborted, causing any await or .then() usage to hang indefinitely. This can cause a control-flow leak that can lead to stalled requests, blocked workers, or degraded application availability.