@webassemblyjs/leb128
LEB128 decoder and encoder
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| bogus-package | bogus-package | AI (bogus-package): Scoped utility library with minimal metadata is normal; publisher is trusted with strong track record; 2937-day age and 72 versions confirm legitimacy. | ai | |
| dependencies | unvetted-dep:@xtuc/long | AI (dependencies): @xtuc/long is the publisher's own long.js fork, consistently used across the webassemblyjs ecosystem at a stable pinned version. Not a suspicious dependency. | ai | |
| dependencies | unvetted-dep:leb | AI (dependencies): leb is the canonical LEB128 library; dependency is appropriate and stable for this package. | ai | |
| phantom-deps | phantom-dep:leb | AI (phantom-deps): leb is used indirectly through config/build; phantom dependency is expected and stable. | ai | |
| provenance | no-provenance | AI (provenance): Accepted risk: this is a long-established package predating Sigstore provenance; no provenance is expected and consistent across all versions. | ai |
Versions (showing 51 of 65)
| Version | Deps | Published |
|---|---|---|
| 1.14.1 | 1 / 0 | |
| 1.14.0 | 1 / 0 | |
| 1.13.2 | 1 / 0 | |
| 1.13.1 | 1 / 0 | |
| 1.13.0 | 1 / 0 | |
| 1.12.1 | 1 / 0 | |
| 1.12.0 | 1 / 0 | |
| 1.11.6 | 1 / 0 | |
| 1.11.5 | 1 / 0 | |
| 1.11.4 | 1 / 0 | |
| 1.11.1 | 1 / 0 | |
| 1.11.0 | 1 / 0 | |
| 1.10.1 | 1 / 0 | |
| 1.10.0 | 1 / 0 | |
| 1.9.1 | 1 / 0 | |
| 1.9.0 | 1 / 0 | |
| 1.8.5 | 1 / 0 | |
| 1.8.4 | 1 / 0 | |
| 1.8.3 | 1 / 0 | |
| 1.8.2 | 1 / 0 | |
| 1.8.1 | 1 / 0 | |
| 1.8.0 | 1 / 0 | |
| 1.7.11 | 1 / 0 | |
| 1.7.10 | 1 / 0 | |
| 1.7.9 | 1 / 0 | |
| 1.7.8 | 1 / 0 | |
| 1.7.7 | 1 / 0 | |
| 1.7.6 | 1 / 0 | |
| 1.7.5 | 1 / 0 | |
| 1.7.4 | 2 / 0 | |
| 1.7.3 | 2 / 0 | |
| 1.7.2 | 2 / 0 | |
| 1.7.1 | 1 / 0 | |
| 1.7.0 | 1 / 0 | |
| 1.6.1 | 1 / 0 | |
| 1.6.0 | 1 / 0 | |
| 1.5.13 | 1 / 0 | |
| 1.5.12 | 1 / 0 | |
| 1.5.11 | 1 / 0 | |
| 1.5.10 | 1 / 0 | |
| 1.5.9 | 1 / 0 | |
| 1.5.8 | 1 / 0 | |
| 1.5.7 | 1 / 0 | |
| 1.5.6 | 1 / 0 | |
| 1.5.5 | 1 / 0 | |
| 1.5.4 | 1 / 0 | |
| 1.5.3 | 1 / 0 | |
| 1.5.2 | 1 / 0 | |
| 1.5.1 | 1 / 0 | |
| 1.5.0 | 1 / 0 | |
| 1.4.3 | 1 / 0 |
v1.13.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.5.11
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.5.10
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.5.9
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.5.8
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.5.7
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.5.6
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.5.4
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.5.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.5.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.5.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.