← Home

api-client

npm Repository Homepage

Object Oriented library for HTTP Web API clients

15
Versions
—
License
No
Install Scripts
Missing
Provenance

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.

Maintainers

doug

Keywords

restweb serviceapiclient

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
dependencies unvetted-dep:request AI (dependencies): Package pins [email protected], consistent with its age (4748 days). No OSV advisories flagged. This is a stable, expected dependency for this package. ai
provenance no-provenance AI (provenance): Package is 4748 days old, predating Sigstore provenance by years. Absence is expected and not a meaningful risk signal for this package. ai
npm-metadata url-dep:config AI (npm-metadata): URL dep points to the canonical lorenwest/node-config GitHub repo; this pattern has been stable across all 22 versions of this long-lived package. ai
semgrep semgrep:dynamic-require AI (semgrep): Dynamic require constructs a path from dirname+file for a plugin-loader pattern; no attacker-controlled input path evident. Stable across versions. ai

Versions (showing 15 of 15)

Version Deps Published
2.0.2 1 / 3
2.0.1 2 / 2
2.0.0 2 / 2
1.0.6 3 / 9
1.0.4 3 / 9
1.0.3 3 / 9
1.0.1 3 / 9
1.0.0 3 / 9
0.0.8 3 / 9
0.0.7 3 / 8
0.0.5 3 / 7
0.0.4 3 / 7
0.0.3 3 / 7
0.0.2 3 / 7
0.0.1 3 / 7

v2.0.2

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.0.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.0.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.0.6

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.0.4

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.0.3

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.0.1

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.0.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.