ipfs-grpc-client — Greenflagged

A client library for the IPFS gRPC API

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.

Maintainers

achingbrainipfs-npm-publisher-botnpm-service-account-ipfs

Keywords

ipfs

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
maintainer-change	maintainer-added	AI (maintainer-change): npm-service-account-ipfs is the IPFS project's shared CI/CD publishing account with 133 approved packages and 0 rejections; this is a legitimate org-level transition.	ai	2026/04/24
provenance	publisher-changed	AI (provenance): achingbrain is the primary js-ipfs maintainer; transition from ipfs-npm-publisher-bot to direct maintainer publishing is a documented, legitimate workflow change for this package.	ai	2026/04/24
provenance	missing-githead	AI (provenance): Missing gitHead is consistent with the publish workflow change from bot to direct maintainer; no other tampering indicators present.	ai	2026/04/24
publish-pattern	new-deps-added	AI (publish-pattern): multiformats is the well-known IPFS ecosystem successor to cids; this is a standard migration in the js-ipfs monorepo, not a suspicious dependency addition.	ai	2026/04/24
dependencies	unvetted-dep:protobufjs	AI (dependencies): protobufjs is a well-known, widely-used protobuf library; its use is expected and appropriate for a gRPC client package.	ai	2026/04/24
provenance	no-provenance	AI (provenance): Established IPFS ecosystem package from a trusted publisher; lack of Sigstore provenance is not a security risk for this package.	ai	2026/04/24
source-diff	net-exec-file:dist/index.min.js	AI (source-diff): dist/index.min.js is a legitimate aegir-built browser bundle for the IPFS gRPC client. Network calls and dynamic patterns are expected in this gRPC/WebSocket client bundle.	ai	2026/04/24
source-diff	source-size-tripled	AI (source-diff): Size increase is due to addition of a browser dist bundle (dist/index.min.js) produced by aegir build — a standard artifact for IPFS JS packages.	ai	2026/04/24
source-diff	net-exec-file:index.min.js	AI (source-diff): index.min.js is a legitimate UMD browser bundle of the ipfs-grpc-client library. Network calls are gRPC/WebSocket client operations; no dropper/loader behavior present.	ai	2026/04/24
source-diff	large-new-source-files	AI (source-diff): New files are browser bundle artifacts (UMD/minified distribution) consistent with this IPFS client library adding browser support. Not injected or malicious code.	ai	2026/04/24
bogus-package	bogus-package	AI (bogus-package): Tiny payload with no deps/description is consistent with a legitimate IPFS ecosystem namespace placeholder by a highly trusted publisher.	ai	2026/04/24
npm-metadata	suspicious-initial-version	AI (npm-metadata): 0.0.0 is a namespace reservation stub by trusted publisher achingbrain; not a malicious throwaway package.	ai	2026/04/24

Versions (showing 41 of 41)

Version	Deps	Published
0.13.1	18 / 4	2023-05-25
0.13.0	18 / 4	2023-01-12
0.12.0	18 / 4	2022-10-24
0.11.1	18 / 4	2022-09-21
0.11.0	18 / 4	2022-09-07
0.10.2	18 / 3	2022-06-24
0.10.1	17 / 3	2022-06-23
0.10.0	17 / 3	2022-05-30
0.9.4	16 / 4	2022-04-26
0.9.3	16 / 4	2022-04-05
0.9.2	16 / 4	2022-02-07
0.9.1	16 / 4	2022-01-27
0.9.0	16 / 4	2021-12-15
0.8.2	16 / 4	2021-11-24
0.8.1	16 / 4	2021-11-19
0.8.0	16 / 4	2021-11-12
0.7.1	16 / 4	2021-09-28
0.7.0	16 / 4	2021-09-24
0.6.5	16 / 4	2021-09-17
0.6.4	16 / 4	2021-09-17
0.6.3	16 / 4	2021-09-02
0.6.2	16 / 4	2021-08-25
0.6.1	16 / 4	2021-08-17
0.6.0	16 / 4	2021-08-17
0.5.0	15 / 4	2021-08-11
0.4.1	15 / 4	2021-07-30
0.4.0	15 / 4	2021-07-27
0.3.3	15 / 4	2021-06-18
0.3.2	15 / 4	2021-06-05
0.3.1	15 / 4	2021-05-26
0.3.0	15 / 4	2021-05-10
0.2.5	13 / 4	2021-05-07
0.2.4	13 / 4	2021-03-10
0.2.3	13 / 4	2021-03-09
0.2.2	13 / 4	2021-02-08
0.2.1	13 / 4	2021-02-02
0.2.0	13 / 4	2021-02-01
0.1.2	13 / 5	2021-01-22
0.1.1	13 / 5	2021-01-20
0.1.0	13 / 5	2021-01-15
0.0.0	0 / 0	2020-11-02

v0.13.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.13.0

2 findings

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: achingbrain → npm-service-account-ipfs (on 2023-01-12) provenance

[Accepted risk] This version was published by a different npm account than previous versions on 2023-01-12. This could indicate a legitimate maintainer transition or an account compromise.

v0.12.0

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.11.1

2 findings

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: achingbrain → npm-service-account-ipfs (on 2022-09-21) provenance

[Accepted risk] This version was published by a different npm account than previous versions on 2022-09-21. This could indicate a legitimate maintainer transition or an account compromise.

v0.11.0

2 findings

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: achingbrain → npm-service-account-ipfs (on 2022-09-07) provenance

[Accepted risk] This version was published by a different npm account than previous versions on 2022-09-07. This could indicate a legitimate maintainer transition or an account compromise.

v0.10.2

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.10.1

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.10.0

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.9.4

2 findings

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Missing gitHead — previous versions had it provenance

[Accepted risk] This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: achingbrain.

v0.9.3

2 findings

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Missing gitHead — previous versions had it provenance

[Accepted risk] This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: achingbrain.

v0.9.2

3 findings

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Missing gitHead — previous versions had it provenance

[Accepted risk] This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: ipfs-npm-publisher-bot.

INFO Publisher changed: achingbrain → ipfs-npm-publisher-bot (on 2022-02-07) provenance

[Accepted risk] This version was published by a different npm account than previous versions on 2022-02-07. This could indicate a legitimate maintainer transition or an account compromise.

v0.9.1

3 findings

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Missing gitHead — previous versions had it provenance

[Accepted risk] This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: ipfs-npm-publisher-bot.

INFO Publisher changed: achingbrain → ipfs-npm-publisher-bot (on 2022-01-27) provenance

[Accepted risk] This version was published by a different npm account than previous versions on 2022-01-27. This could indicate a legitimate maintainer transition or an account compromise.

v0.9.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.8.2

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.8.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.8.0

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.7.1

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.7.0

2 findings

HIGH New file with network + code execution: index.min.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.6.5

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.6.4

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.6.3

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.6.2

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.6.1

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.6.0

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.5.0

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.4.1

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.4.0

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.3.3

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.3.2

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.3.1

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.3.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.2.5

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.2.4

2 findings

HIGH New file with network + code execution: dist/index.min.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.2.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.2.2

2 findings

HIGH New file with network + code execution: dist/index.min.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.2.1

2 findings

HIGH New file with network + code execution: dist/index.min.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.2.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.1.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.1.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.1.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.