openid-client
OAuth 2 / OpenID Connect Client API for JavaScript Runtimes
Supply chain provenance
Status for the latest visible version.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| provenance | publisher-changed | AI (provenance): Publisher changed from panva personal account to GitHub Actions CI/CD with SLSA provenance attestation. This is a standard, positive migration for panva's packages. | ai | |
| publish-pattern | dormant-publish | AI (publish-pattern): Mature package (218 versions, 8M downloads) by well-known maintainer panva. Dormancy gap is not indicative of compromise given SLSA provenance and consistent repo ownership. | ai | |
| source-diff | large-new-source-files | AI (source-diff): 23 new files is normal for a mature package evolution; no evidence of bundled/injected code in this well-established project. | ai | |
| publish-pattern | new-deps-added | AI (publish-pattern): jose is an established cryptographic library by the same author; adding it for OpenID Connect support is contextually appropriate and not a supply-chain attack vector. | ai | |
| semgrep | semgrep:base64-decode | AI (semgrep): Base64url decoding is a documented part of JWT/OIDC spec; standard utility function with no suspicious context. | ai | |
| provenance | no-provenance | AI (provenance): openid-client is a long-established, high-download package published well before Sigstore provenance was available on npm. No provenance is expected and not a risk signal here. | ai | |
| dependencies | unvetted-dep:oauth4webapi | AI (dependencies): oauth4webapi is a well-established OAuth library by the same author (panva); unvetted status is a registry artifact, not a real risk signal for this package. | ai | |
| dependencies | unvetted-dep:jose | AI (dependencies): jose is an established cryptographic library by panva; appropriate for OpenID Connect token handling. | ai |
Versions (showing 51 of 69)
| Version | Deps | Published |
|---|---|---|
| 6.8.4 | 2 / 30 | |
| 6.8.3 | 2 / 30 | |
| 6.8.2 | 2 / 29 | |
| 6.8.1 | 2 / 29 | |
| 6.8.0 | 2 / 29 | |
| 6.7.1 | 2 / 29 | |
| 6.7.0 | 2 / 29 | |
| 6.6.4 | 2 / 29 | |
| 6.6.3 | 2 / 29 | |
| 6.6.2 | 2 / 29 | |
| 6.6.1 | 2 / 29 | |
| 6.6.0 | 2 / 29 | |
| 6.5.3 | 2 / 28 | |
| 6.5.2 | 2 / 28 | |
| 6.5.1 | 2 / 28 | |
| 6.5.0 | 2 / 28 | |
| 6.4.2 | 2 / 28 | |
| 6.4.1 | 2 / 29 | |
| 6.4.0 | 2 / 29 | |
| 6.3.4 | 2 / 29 | |
| 6.3.3 | 2 / 29 | |
| 6.3.2 | 2 / 29 | |
| 6.3.1 | 2 / 29 | |
| 6.3.0 | 2 / 29 | |
| 6.2.0 | 2 / 29 | |
| 6.1.7 | 2 / 29 | |
| 6.1.6 | 2 / 29 | |
| 6.1.5 | 2 / 29 | |
| 6.1.4 | 2 / 29 | |
| 6.1.3 | 2 / 29 | |
| 6.1.2 | 2 / 29 | |
| 6.1.1 | 2 / 29 | |
| 6.1.0 | 2 / 29 | |
| 6.0.0 | 2 / 29 | |
| 5.7.1 | 4 / 10 | |
| 5.7.0 | 4 / 10 | |
| 5.6.5 | 4 / 10 | |
| 5.6.4 | 4 / 10 | |
| 5.6.3 | 4 / 10 | |
| 5.6.2 | 4 / 10 | |
| 5.6.1 | 4 / 10 | |
| 5.6.0 | 4 / 10 | |
| 5.5.0 | 4 / 11 | |
| 5.4.3 | 4 / 11 | |
| 5.4.2 | 4 / 11 | |
| 5.4.1 | 4 / 11 | |
| 5.4.0 | 4 / 11 | |
| 5.3.4 | 4 / 11 | |
| 5.3.3 | 4 / 11 | |
| 5.3.2 | 4 / 11 | |
| 5.3.1 | 4 / 11 |
v6.8.2
2 findingsThis version was published by a different npm account than previous versions on 2026-02-07. This could indicate a legitimate maintainer transition or an account compromise.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v6.8.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v6.8.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v6.7.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v6.7.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v6.6.4
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v6.6.3
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v6.6.2
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v6.6.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v6.6.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v6.5.3
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v6.5.2
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v6.5.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v6.5.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v6.4.2
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v6.4.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v6.4.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v6.3.4
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v6.3.3
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v6.3.2
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v6.3.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v6.3.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v6.2.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v6.1.7
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v6.1.6
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v6.1.5
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v6.1.4
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v6.1.3
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v6.1.2
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v6.1.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v6.1.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v6.0.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v5.7.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v5.7.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v5.6.5
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v5.6.4
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v5.6.3
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v5.6.2
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v5.6.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v5.6.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v5.5.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v0.2). This is the strongest supply chain integrity signal.
v5.4.3
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v0.2). This is the strongest supply chain integrity signal.
v5.4.2
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v0.2). This is the strongest supply chain integrity signal.
v5.4.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v0.2). This is the strongest supply chain integrity signal.
v5.4.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.3.4
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.3.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.3.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.3.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.