https-proxy-agent MIT 20 versions

https-proxy-agent

npm Repository Homepage

An HTTP(s) proxy `http.Agent` implementation for HTTPS

20

Versions

MIT

License

No

Install Scripts

Verified

Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures No source commit

Maintainers

tootallnate

Keywords

httpsproxyendpointagent

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
provenance	slsa-provenance	AI (provenance): Package publishes via GitHub Actions with SLSA/Sigstore attestation — this is the expected publish pattern for this package going forward.	ai	2026/04/22
provenance	publisher-changed	AI (provenance): Publisher changed to GitHub Actions CI/CD, which is a legitimate and more secure publish pattern. SLSA attestation confirms the build origin.	ai	2026/04/22
provenance	missing-githead	AI (provenance): gitHead is absent because publish is now automated via GitHub Actions rather than local npm CLI. SLSA provenance provides stronger commit linkage.	ai	2026/04/22
publish-pattern	dormant-publish	AI (publish-pattern): Dormancy followed by major version bump reflects a legitimate large refactor (ESM migration, monorepo restructure), not account takeover. SLSA attestation corroborates legitimacy.	ai	2026/04/22

Versions (showing 20 of 20)

Version	Deps	Published
9.0.0	2 / 8	2026-04-01
8.0.0	2 / 8	2026-03-11
7.0.6	2 / 11	2024-12-07
7.0.5	2 / 11	2024-06-28
7.0.4	2 / 11	2024-02-15
7.0.3	2 / 11	2024-02-12
7.0.2	2 / 11	2023-09-04
7.0.1	2 / 11	2023-07-10
7.0.0	2 / 11	2023-05-25
6.2.1	2 / 11	2023-05-24
6.2.0	2 / 11	2023-05-18
6.1.0	2 / 11	2023-05-05
6.0.0	2 / 11	2023-05-04
5.0.1	2 / 15	2022-04-14
5.0.0	2 / 15	2020-02-07
4.0.0	2 / 2	2019-12-10
3.0.1	2 / 2	2019-10-23
3.0.0	2 / 2	2019-10-07
2.2.4	2 / 2	2019-10-25
2.2.3	2 / 2	2019-10-22

v7.0.4

2 findings

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Missing gitHead — previous versions had it provenance

[Accepted risk] This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: tootallnate.

v7.0.3

2 findings

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Missing gitHead — previous versions had it provenance

[Accepted risk] This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: tootallnate.

v7.0.2

2 findings

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Missing gitHead — previous versions had it provenance

[Accepted risk] This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: tootallnate.

v7.0.1

2 findings

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Missing gitHead — previous versions had it provenance

[Accepted risk] This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: tootallnate.

v7.0.0

2 findings

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Missing gitHead — previous versions had it provenance

[Accepted risk] This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: tootallnate.

v6.2.1

2 findings

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Missing gitHead — previous versions had it provenance

[Accepted risk] This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: tootallnate.

v6.2.0

2 findings

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Missing gitHead — previous versions had it provenance

[Accepted risk] This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: tootallnate.

v6.1.0

2 findings

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Missing gitHead — previous versions had it provenance

[Accepted risk] This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: tootallnate.

v6.0.0

2 findings

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Missing gitHead — previous versions had it provenance

[Accepted risk] This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: tootallnate.

v5.0.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v4.0.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.0.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.0.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.2.4

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.2.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.