batch MIT 17 versions

batch

npm Repository Homepage

Simple async batch with concurrency control and progress reporting.

17

Versions

MIT

License

No

Install Scripts

Missing

Provenance

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.

Maintainers

dougwilsontjholowaychuk

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
provenance	publisher-changed	AI (provenance): tjholowaychuk → dougwilson is a well-known, legitimate maintainer transition across the Express ecosystem.	ai	2026/04/24
maintainer-change	maintainer-added	AI (maintainer-change): dougwilson is the established maintainer of many former TJ Holowaychuk packages; legitimate transfer.	ai	2026/04/24
publish-pattern	dormant-publish	AI (publish-pattern): Dormancy consistent with the known TJ → dougwilson maintenance handoff across the Express ecosystem.	ai	2026/04/24
phantom-deps	phantom-dep:mocha	AI (phantom-deps): Test dependencies in package.json but not imported in main code; stable pattern for test frameworks.	ai	2026/04/24
phantom-deps	phantom-dep:should	AI (phantom-deps): Test dependencies in package.json but not imported in main code; stable pattern for test frameworks.	ai	2026/04/24
bogus-package	bogus-package	AI (bogus-package): Minimalist early-stage package (2009); small entry point and missing metadata are intentional design, not malware indicators.	ai	2026/04/24

Versions (showing 17 of 17)

Version	Deps	Published
0.6.1	0 / 2	2017-05-16
0.6.0	0 / 2	2017-03-26
0.5.3	0 / 2	2015-10-01
0.5.2	0 / 2	2014-12-22
0.5.1	0 / 2	2014-06-19
0.5.0	0 / 2	2013-07-29
0.4.0	0 / 2	2013-06-06
0.3.2	0 / 2	2013-03-15
0.3.1	0 / 2	2013-03-13
0.3.0	0 / 2	2013-03-13
0.2.1	0 / 2	2012-11-08
0.2.0	2 / 0	2012-10-04
0.1.1	2 / 0	2012-07-03
0.1.0	2 / 0	2012-07-03
0.0.3	2 / 0	2012-06-02
0.0.2	2 / 0	2012-02-13
0.0.1	2 / 0	2012-01-17

v0.6.0

2 findings

HIGH Publisher changed: tjholowaychuk → dougwilson (on 2017-03-26) provenance

This version was published by a different npm account than previous versions on 2017-03-26. This could indicate a legitimate maintainer transition or an account compromise.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.5.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.5.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.5.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.5.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.4.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.3.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.3.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.3.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.2.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.2.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.1.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.1.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.