koa-body
A Koa body parser middleware. Supports multipart, urlencoded and JSON request bodies.
Supply chain provenance
Status for the latest visible version.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| provenance | publisher-changed | AI (provenance): Transition from dlau to markherhold is consistent with a legitimate koajs org maintainer handoff; repo remains under github.com/koajs/koa-body and new publisher has a clean track record. | ai | |
| publish-pattern | new-deps-added | AI (publish-pattern): zod is a well-vetted schema library; @types/* packages are type-only with no executable code. Addition is explained by TypeScript migration in v6. | ai | |
| provenance | missing-githead | AI (provenance): koa-body publishes via GitHub Actions with SLSA provenance attestation, which supersedes gitHead as a supply chain integrity signal. Missing gitHead reflects CI pipeline change, not suspicious activity. | ai | |
| phantom-deps | phantom-dep:@types/koa | AI (phantom-deps): @types/koa is a TypeScript ambient type package; not directly imported as a module but used for type inference. Stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:@types/co-body | AI (phantom-deps): @types/co-body is a TypeScript ambient type package; not directly imported as a module. Stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:@types/formidable | AI (phantom-deps): @types/formidable is a TypeScript ambient type package; not directly imported as a module. Stable false positive for this package. | ai |
Versions (showing 46 of 46)
| Version | Deps | Published |
|---|---|---|
| 8.0.0 | 7 / 16 | |
| 7.0.1 | 7 / 15 | |
| 7.0.0 | 6 / 15 | |
| 6.0.1 | 6 / 14 | |
| 6.0.0 | 6 / 14 | |
| 5.0.0 | 3 / 7 | |
| 4.2.0 | 3 / 7 | |
| 4.1.3 | 3 / 7 | |
| 4.1.2 | 3 / 7 | |
| 4.1.1 | 3 / 7 | |
| 4.1.0 | 3 / 7 | |
| 4.0.8 | 3 / 7 | |
| 4.0.7 | 3 / 7 | |
| 4.0.6 | 3 / 7 | |
| 4.0.5 | 3 / 7 | |
| 4.0.4 | 3 / 6 | |
| 4.0.3 | 2 / 7 | |
| 4.0.2 | 2 / 7 | |
| 4.0.1 | 2 / 6 | |
| 4.0.0 | 2 / 6 | |
| 3.0.0 | 2 / 7 | |
| 2.6.0 | 2 / 8 | |
| 2.5.0 | 2 / 8 | |
| 2.4.0 | 2 / 8 | |
| 2.3.0 | 2 / 7 | |
| 2.1.0 | 2 / 7 | |
| 2.0.1 | 2 / 7 | |
| 2.0.0 | 3 / 6 | |
| 1.7.0 | 3 / 8 | |
| 1.6.0 | 3 / 8 | |
| 1.5.0 | 3 / 8 | |
| 1.4.0 | 3 / 8 | |
| 1.3.0 | 3 / 8 | |
| 1.2.1 | 3 / 8 | |
| 1.2.0 | 3 / 8 | |
| 1.1.0 | 3 / 8 | |
| 1.0.1 | 3 / 7 | |
| 1.0.0 | 3 / 7 | |
| 0.4.0 | 3 / 7 | |
| 0.3.0 | 3 / 7 | |
| 0.2.0 | 3 / 7 | |
| 0.1.0 | 1 / 4 | |
| 0.0.4 | 1 / 0 | |
| 0.0.3 | 1 / 0 | |
| 0.0.2 | 1 / 0 | |
| 0.0.1 | 1 / 0 |
v8.0.0
2 findingsPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
[Accepted risk] This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: GitHub Actions.
v7.0.1
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: GitHub Actions.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v7.0.0
3 findingsThis version was published by a different npm account than previous versions on 2025-10-23. This could indicate a legitimate maintainer transition or an account compromise.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
[Accepted risk] This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: GitHub Actions.
v6.0.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v6.0.0
2 findingsThis version was published by a different npm account than previous versions on 2022-10-27. This could indicate a legitimate maintainer transition or an account compromise.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.