got — Greenflagged

Human-friendly and powerful HTTP request library for Node.js

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.

Maintainers

sindresorhus

Keywords

httphttpshttp2getgoturlurirequestsimplecurlwgetfetchnetnetworkgzipbrotlizstdzstandardrequestshuman-friendlyaxiossuperagentnode-fetchky

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
provenance	publisher-changed	AI (provenance): szmarczak is a documented long-standing co-maintainer of got and author of @szmarczak/http-timer (already a dep). The transition from sindresorhus is a known legitimate handoff, not a compromise.	ai	2026/04/22
phantom-deps	phantom-dep:@types/cacheable-request	AI (phantom-deps): Type-only dependency; not directly imported at runtime but required for TypeScript consumers. Expected pattern for a TypeScript library.	ai	2026/04/22
dependencies	unvetted-dep:@types/responselike	AI (dependencies): got is a TypeScript library that ships types; @types/responselike is a legitimate type-only runtime dep needed by consumers for TypeScript compatibility. Stable pattern for this package.	ai	2026/04/22
dependencies	unvetted-dep:@types/cacheable-request	AI (dependencies): got is a TypeScript library that ships types; @types/cacheable-request is a legitimate type-only runtime dep needed by consumers for TypeScript compatibility. Stable pattern for this package.	ai	2026/04/22
phantom-deps	phantom-dep:@types/responselike	AI (phantom-deps): Type-only dependency; not directly imported at runtime but required for TypeScript consumers. Expected pattern for a TypeScript library.	ai	2026/04/22
dependencies	unvetted-dep:@sindresorhus/is	AI (dependencies): @sindresorhus/is is published by the same author (sindresorhus) and is a core utility used across many of his packages. No security concern.	ai	2026/04/22
dependencies	unvetted-dep:cacheable-lookup	AI (dependencies): cacheable-lookup is a well-known DNS caching utility, a stable dependency of got. No security concern.	ai	2026/04/22
dependencies	unvetted-dep:form-data-encoder	AI (dependencies): form-data-encoder is a legitimate form data encoding package, a stable dependency of got. No security concern.	ai	2026/04/22
dependencies	unvetted-dep:@szmarczak/http-timer	AI (dependencies): @szmarczak/http-timer is a well-known HTTP timing utility, a stable dependency of got. No security concern.	ai	2026/04/22
dependencies	unvetted-dep:cacheable-request	AI (dependencies): cacheable-request is a well-known HTTP caching utility, a stable dependency of got. No security concern.	ai	2026/04/22
dependencies	unvetted-dep:p-cancelable	AI (dependencies): p-cancelable is a well-known sindresorhus package, a stable dependency of got across many versions. No security concern.	ai	2026/04/22
dependencies	unvetted-dep:responselike	AI (dependencies): responselike is a legitimate, established utility package used by got. No security concern.	ai	2026/04/22
dependencies	unvetted-dep:http2-wrapper	AI (dependencies): http2-wrapper is a well-known HTTP/2 utility package, a stable dependency of got. No security concern.	ai	2026/04/22
dependencies	unvetted-dep:lowercase-keys	AI (dependencies): lowercase-keys is a well-known sindresorhus utility package, a stable dependency of got. No security concern.	ai	2026/04/22
maintainer-change	maintainer-removed	AI (maintainer-change): szmarczak was a long-time co-maintainer; sindresorhus remains publisher. Normal project evolution, not a takeover.	ai	2026/04/22
provenance	no-provenance	AI (provenance): got is a well-established package from a highly trusted publisher (sindresorhus); lack of Sigstore provenance is not a meaningful risk signal here.	ai	2026/04/21