← Home

koa-webpack

npm Repository Homepage

Development and Hot Reload Middleware for Koa2

39
Versions
MPL-2.0
License
No
Install Scripts
Missing
Provenance

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.

Maintainers

shellscape

Keywords

koamiddlewarewebpack

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
semgrep semgrep:dynamic-require AI (semgrep): Dynamic require is used to load the user's webpack config file — this is the core purpose of a webpack middleware package and is intentional, not malicious. ai
publish-pattern new-deps-added AI (publish-pattern): The new dep 'joi' is the canonical replacement for the removed '@hapi/joi' — same Hapi team, well-known migration path. Not a suspicious dependency addition. ai

Versions (showing 39 of 39)

Version Deps Published
6.0.0 6 / 14
5.3.0 7 / 21
5.2.5 7 / 21
5.2.4 7 / 22
5.2.3 7 / 22
5.2.2 7 / 22
5.2.1 7 / 22
5.2.0 7 / 22
5.1.1 7 / 31
5.1.0 7 / 31
5.0.2 7 / 31
5.0.1 7 / 31
5.0.0 7 / 31
4.0.0 5 / 18
3.0.2 5 / 18
3.0.1 5 / 18
3.0.0 5 / 17
2.0.3 5 / 15
2.0.2 5 / 15
2.0.1 5 / 15
2.0.0 6 / 17
1.1.0 6 / 17
1.0.0 5 / 14
0.6.0 5 / 19
0.5.1 5 / 19
0.5.0 5 / 19
0.4.0 5 / 15
0.3.1 5 / 15
0.3.0 5 / 15
0.2.2 4 / 14
0.2.1 4 / 14
0.2.0 4 / 14
0.1.10 4 / 14
0.1.9 4 / 14
0.1.8 4 / 14
0.1.7 4 / 14
0.1.6 4 / 14
0.1.1 4 / 14
0.0.1 4 / 1

v6.0.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v5.3.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v5.2.5

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v5.2.4

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v5.2.3

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v5.2.2

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v5.2.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v5.2.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v5.1.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v5.1.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v5.0.2

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v5.0.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v5.0.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.