← Home

nanobus

npm Repository Homepage

Tiny message bus

25
Versions
MIT
License
No
Install Scripts
Missing
Provenance

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.

Maintainers

benlyns3ththompsonsubstackyoshuawuytsbretlrlnayerkopalmajuliangrubertimwisahdinosaurtoddselfsethvincentmaxogdenshamafreeman-labferossemilbayescolingourlayjameskyburzalmostslaskisungoldmangraforlocktornqvistamongiantsgoto-bus-stopmafintosh

Keywords

emitevent

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
provenance publisher-changed AI (provenance): Publisher change from goto-bus-stop to toddself occurred in 2018 (~6 years ago); toddself has a clean track record (64 approved, 0 rejected) and is the established maintainer of this package. ai
phantom-deps phantom-dep:nanoassert AI (phantom-deps): nanoassert is used via the browser field alias in package.json ('assert': 'nanoassert'), a standard browser bundling pattern — not a phantom dependency. ai

Versions (showing 25 of 25)

Version Deps Published
4.5.0 3 / 8
4.4.0 3 / 8
4.3.5 3 / 8
4.3.4 3 / 8
4.3.3 2 / 8
4.3.2 2 / 8
4.3.1 2 / 5
4.3.0 2 / 5
4.2.0 2 / 5
4.1.0 2 / 5
4.0.0 1 / 5
3.3.0 1 / 5
3.2.1 1 / 5
3.2.0 1 / 5
3.1.0 0 / 5
3.0.0 0 / 5
2.3.0 0 / 5
2.2.2 0 / 5
2.2.1 0 / 4
2.2.0 0 / 4
2.1.0 0 / 4
2.0.1 0 / 4
2.0.0 0 / 4
1.0.0 0 / 4
0.0.0 0 / 0

v4.5.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v4.4.0

2 findings
HIGH Publisher changed: toddself → goto-bus-stop (on 2018-12-13) provenance

This version was published by a different npm account than previous versions on 2018-12-13. This could indicate a legitimate maintainer transition or an account compromise.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v4.3.5

2 findings
HIGH Publisher changed: goto-bus-stop → toddself (on 2018-10-28) provenance

This version was published by a different npm account than previous versions on 2018-10-28. This could indicate a legitimate maintainer transition or an account compromise.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v4.3.4

2 findings
HIGH Publisher changed: yoshuawuyts → goto-bus-stop (on 2018-09-08) provenance

This version was published by a different npm account than previous versions on 2018-09-08. This could indicate a legitimate maintainer transition or an account compromise.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v4.3.3

2 findings
HIGH Publisher changed: yoshuawuyts → tornqvist (on 2018-02-13) provenance

This version was published by a different npm account than previous versions on 2018-02-13. This could indicate a legitimate maintainer transition or an account compromise.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v4.3.2

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v4.3.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v4.3.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v4.2.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v4.1.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v4.0.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.3.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.2.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.2.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.1.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.0.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.