@trpc/server
Supply chain provenance
Status for the latest visible version.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | obfuscated-file:dist/unstable-core-do-not-import.d-BdVSvUCr.d.mts | AI (source-diff): TypeScript declaration file with long lines from bundled type definitions; not obfuscated code. | ai | |
| source-diff | obfuscated-file:dist/unstable-core-do-not-import.d-Dh9CT5RO.d.cts | AI (source-diff): TypeScript declaration file with long lines from bundled type definitions; not obfuscated code. | ai | |
| source-diff | obfuscated-file:dist/unstable-core-do-not-import.d-Dm2ii-ih.d.cts | AI (source-diff): TypeScript declaration file (.d.cts) with bundled type definitions. Long lines are a known artifact of declaration bundlers (e.g. rollup-plugin-dts), not obfuscation. Content is clearly readable tRPC types. | ai | |
| source-diff | obfuscated-file:dist/unstable-core-do-not-import.d-Bl-_61JQ.d.mts | AI (source-diff): TypeScript declaration file (.d.mts) with bundled type definitions. Long lines are a known artifact of declaration bundlers, not obfuscation. Content is clearly readable tRPC types. | ai | |
| source-diff | obfuscated-file:dist/unstable-core-do-not-import.d-DJljFxtY.d.mts | AI (source-diff): File is a TypeScript declaration file (.d.mts). Long lines are complex TypeScript generic/union type definitions, not obfuscated code. Sample confirms readable, commented type declarations. | ai | |
| source-diff | obfuscated-file:dist/unstable-core-do-not-import.d-Hlj_hEnF.d.cts | AI (source-diff): File is a TypeScript declaration file (.d.cts). Long lines are complex TypeScript generic/union type definitions, not obfuscated code. Sample confirms readable, commented type declarations. | ai | |
| maintainer-change | maintainer-removed | AI (maintainer-change): Maintainer removal is consistent with transition to GitHub Actions CI/CD publishing. Expected organizational change for tRPC project. | ai | |
| publish-pattern | dormant-publish | AI (publish-pattern): Package has 1342 versions in registry indicating active development. Dormancy signal is likely a data artifact or version-series gap, not actual inactivity. | ai | |
| source-diff | obfuscated-file:dist/unstable-core-do-not-import.d-BxnV2Pug.d.mts | AI (source-diff): File is a bundled TypeScript declaration file (.d.mts) with readable, well-commented type definitions. Long lines are from bundler concatenation, not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/unstable-core-do-not-import.d-DEjy79nN.d.cts | AI (source-diff): File is a bundled TypeScript declaration file (.d.cts) with readable, well-commented type definitions. Long lines are from bundler concatenation, not obfuscation. | ai | |
| provenance | publisher-changed | AI (provenance): tRPC migrated to GitHub Actions CI/CD publishing with SLSA provenance attestation. This is a legitimate and documented transition for the project, not an account compromise. | ai | |
| semgrep | semgrep:base64-decode | AI (semgrep): Base64 decoding in AWS Lambda adapter is standard practice for handling binary request bodies per AWS Lambda's isBase64Encoded flag; not a malicious payload. | ai | |
| typosquat | typosquat.levenshtein:semver | AI (typosquat): @trpc/server is a well-known scoped package in the tRPC ecosystem; Levenshtein match to 'semver' is a false positive with no plausible typosquat scenario. | ai |
Versions (showing 21 of 21)
| Version | Deps | Published |
|---|---|---|
| 11.17.0 | 0 / 29 | |
| 11.16.0 | 0 / 29 | |
| 11.15.2 | 0 / 29 | |
| 11.15.1 | 0 / 29 | |
| 11.15.0 | 0 / 29 | |
| 11.14.1 | 0 / 29 | |
| 11.14.0 | 0 / 28 | |
| 11.13.4 | 0 / 28 | |
| 11.13.3 | 0 / 28 | |
| 11.13.2 | 0 / 28 | |
| 11.13.1 | 0 / 28 | |
| 11.13.0 | 0 / 28 | |
| 11.12.1 | 0 / 28 | |
| 11.12.0 | 0 / 28 | |
| 11.11.0 | 0 / 28 | |
| 11.10.0 | 0 / 28 | |
| 11.9.0 | 0 / 28 | |
| 11.8.1 | 0 / 28 | |
| 11.8.0 | 0 / 28 | |
| 10.45.4 | 0 / 32 | |
| 10.45.3 | 0 / 32 |
v11.17.0
3 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v11.16.0
2 findingsPackage name '@trpc/server' is 1 edit(s) away from popular package 'semver'.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v11.15.2
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v11.15.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v11.15.0
4 findingsThis version was published by a different npm account than previous versions on 2026-03-23. This could indicate a legitimate maintainer transition or an account compromise.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v11.14.1
4 findingsThis version was published by a different npm account than previous versions on 2026-03-20. This could indicate a legitimate maintainer transition or an account compromise.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v11.14.0
4 findingsThis version was published by a different npm account than previous versions on 2026-03-20. This could indicate a legitimate maintainer transition or an account compromise.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v11.13.4
4 findingsThis version was published by a different npm account than previous versions on 2026-03-15. This could indicate a legitimate maintainer transition or an account compromise.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v11.13.3
4 findingsThis version was published by a different npm account than previous versions on 2026-03-15. This could indicate a legitimate maintainer transition or an account compromise.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v11.13.2
4 findingsThis version was published by a different npm account than previous versions on 2026-03-15. This could indicate a legitimate maintainer transition or an account compromise.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v11.13.1
4 findingsThis version was published by a different npm account than previous versions on 2026-03-15. This could indicate a legitimate maintainer transition or an account compromise.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v11.13.0
4 findingsThis version was published by a different npm account than previous versions on 2026-03-15. This could indicate a legitimate maintainer transition or an account compromise.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v11.12.1
4 findingsThis version was published by a different npm account than previous versions on 2026-03-14. This could indicate a legitimate maintainer transition or an account compromise.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v11.12.0
4 findingsThis version was published by a different npm account than previous versions on 2026-03-06. This could indicate a legitimate maintainer transition or an account compromise.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v11.11.0
4 findingsThis version was published by a different npm account than previous versions on 2026-03-01. This could indicate a legitimate maintainer transition or an account compromise.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v11.10.0
4 findingsThis version was published by a different npm account than previous versions on 2026-02-09. This could indicate a legitimate maintainer transition or an account compromise.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v11.9.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v11.8.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v11.8.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v10.45.4
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v10.45.3
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.