github
DEPRECATED: renamed to @octokit/rest
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| provenance | publisher-changed | AI (provenance): Publisher change (octokitbot → gr2m) occurred in 2018 as part of the octokit org transition; gr2m is the canonical octokit maintainer. Stable historical fact, not a risk. | ai | |
| bogus-package | bogus-package | AI (bogus-package): Package is an official deprecation stub redirecting to @octokit/rest. Tiny payload, no deps, and minimal README are expected and intentional for this use case. | ai | |
| source-diff | source-size-dropped | AI (source-diff): Source size drop is intentional — v14.0.0 is a deprecation stub replacing the full library. This is the documented migration path to @octokit/rest. | ai | |
| semgrep | semgrep:dynamic-require | AI (semgrep): Dynamic require resolves to either a Node built-in protocol module or 'follow-redirects/<protocol>' — a controlled, non-arbitrary pattern stable across versions of this package. | ai | |
| phantom-deps | phantom-dep:follow-redirects | AI (phantom-deps): follow-redirects is declared in dependencies and used via dynamic require; the phantom-dep finding is a false positive caused by the dynamic import pattern. | ai |
Versions (showing 51 of 101)
| Version | Deps | Published |
|---|---|---|
| 14.0.0 | 0 / 0 | |
| 13.1.1 | 7 / 17 | |
| 13.1.0 | 7 / 17 | |
| 13.0.2 | 7 / 17 | |
| 13.0.1 | 6 / 17 | |
| 13.0.0 | 5 / 17 | |
| 12.1.0 | 6 / 12 | |
| 12.0.7 | 6 / 12 | |
| 12.0.6 | 6 / 12 | |
| 12.0.5 | 6 / 12 | |
| 12.0.4 | 6 / 12 | |
| 12.0.3 | 6 / 12 | |
| 12.0.2 | 6 / 12 | |
| 12.0.1 | 4 / 10 | |
| 12.0.0 | 4 / 10 | |
| 11.0.0 | 4 / 2 | |
| 10.1.0 | 4 / 2 | |
| 10.0.0 | 4 / 2 | |
| 9.3.1 | 4 / 2 | |
| 9.3.0 | 4 / 2 | |
| 9.2.0 | 4 / 2 | |
| 9.1.0 | 4 / 2 | |
| 9.0.0 | 4 / 2 | |
| 8.2.1 | 4 / 2 | |
| 8.1.1 | 4 / 2 | |
| 8.1.0 | 4 / 2 | |
| 8.0.0 | 4 / 2 | |
| 7.3.2 | 4 / 2 | |
| 7.3.1 | 4 / 2 | |
| 7.2.1 | 4 / 2 | |
| 7.2.0 | 4 / 2 | |
| 7.1.0 | 4 / 2 | |
| 7.0.1 | 4 / 2 | |
| 7.0.0 | 4 / 2 | |
| 6.1.0 | 3 / 2 | |
| 6.0.4 | 3 / 2 | |
| 6.0.3 | 3 / 2 | |
| 6.0.2 | 3 / 1 | |
| 6.0.1 | 3 / 1 | |
| 6.0.0 | 3 / 1 | |
| 5.3.3 | 3 / 1 | |
| 5.2.3 | 3 / 1 | |
| 5.2.2 | 3 / 1 | |
| 5.2.1 | 3 / 1 | |
| 5.2.0 | 3 / 1 | |
| 5.1.0 | 3 / 1 | |
| 5.0.1 | 3 / 1 | |
| 5.0.0 | 3 / 1 | |
| 4.1.1 | 3 / 1 | |
| 4.1.0 | 3 / 1 | |
| 4.0.0 | 3 / 1 |
v14.0.0
2 findingsThis version was published by a different npm account than previous versions on 2018-03-07. This could indicate a legitimate maintainer transition or an account compromise.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v13.1.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v13.1.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v13.0.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v13.0.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v13.0.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.