← Home

composition

npm Repository Homepage

Compose generator and async/await middleware

9
Versions
MIT
License
No
Install Scripts
Missing
Provenance

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.

Maintainers

jongleberrycoderhaoxin

Keywords

cocomposecompositionmiddlewaredecoratordecoratorsasyncawaityield

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
maintainer-change maintainer-added AI (maintainer-change): coderhaoxin was added as co-maintainer during a legitimate major version bump by the original author jongleberry; consistent with normal open-source collaboration. ai
publish-pattern new-deps-added AI (publish-pattern): memorizer and native-or-bluebird are established, legitimate packages appropriate for a middleware composition library adding Promise/async support in v2. ai
source-diff source-size-tripled AI (source-diff): Growth from 301B to 2KB reflects a legitimate major version rewrite adding Promise support; 2KB total is trivially small and not indicative of injected payload. ai

Versions (showing 9 of 9)

Version Deps Published
2.3.0 2 / 6
2.2.1 2 / 6
2.2.0 2 / 6
2.1.2 3 / 6
2.1.1 3 / 6
2.1.0 3 / 4
2.0.1 3 / 4
2.0.0 2 / 5
1.0.0 0 / 0

v2.3.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.2.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.2.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.1.2

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.1.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.1.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.0.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.0.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.0.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.