pacote
JavaScript package downloader
31
Versions
ISC
License
No
Install Scripts
Verified
Provenance
Supply chain provenance
Status for the latest visible version.
SLSA provenance attestation
npm registry signatures
gitHead linked
Maintainers
garsaquibkhannpm-cli-opsreggihashtagchrisowlstronaut
Keywords
packagesnpmgit
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| provenance | publisher-changed | AI (provenance): npm org packages now publish via GitHub Actions CI/CD with SLSA provenance; this is the expected publisher for all future npm CLI packages. | ai | |
| semgrep | semgrep:env-spread | AI (semgrep): pacote spawns npm install for git deps and must pass the parent environment; standard subprocess invocation pattern. | ai | |
| semgrep | semgrep:base64-decode | AI (semgrep): Decodes DSSE envelope payloads from Sigstore attestations; base64 is the canonical encoding per the DSSE spec. | ai | |
| semgrep | semgrep:child-process-import | AI (semgrep): pacote is a git-aware package fetcher; importing child_process to run git commands is core, documented functionality across all versions. | ai | |
| semgrep | semgrep:child-process-spawn | AI (semgrep): Spawning the git binary is the intended mechanism for pacote's git dependency support; stable and expected across all versions. | ai | |
| semgrep | semgrep:env-bulk-read | AI (semgrep): process.env enumeration in git.js is used to filter safe env vars for git subprocess — a security-conscious allowlist pattern, not malicious. Stable for this package. | ai |
Versions (showing 31 of 231)
| Version | Deps | Published |
|---|---|---|
| 2.7.8 | 21 / 12 | |
| 2.7.7 | 21 / 12 | |
| 2.7.6 | 21 / 12 | |
| 2.7.5 | 21 / 12 | |
| 2.7.4 | 21 / 12 | |
| 2.7.3 | 21 / 12 | |
| 2.7.2 | 21 / 12 | |
| 2.7.1 | 21 / 12 | |
| 2.7.0 | 21 / 12 | |
| 2.6.0 | 21 / 12 | |
| 2.5.0 | 21 / 12 | |
| 2.4.0 | 21 / 12 | |
| 2.3.2 | 20 / 12 | |
| 2.3.1 | 20 / 12 | |
| 2.3.0 | 20 / 12 | |
| 2.2.2 | 20 / 12 | |
| 2.2.1 | 18 / 12 | |
| 2.2.0 | 18 / 12 | |
| 2.1.2 | 18 / 12 | |
| 2.1.1 | 18 / 12 | |
| 2.1.0 | 18 / 12 | |
| 2.0.5 | 18 / 12 | |
| 2.0.4 | 18 / 12 | |
| 2.0.3 | 19 / 12 | |
| 2.0.2 | 19 / 12 | |
| 2.0.1 | 19 / 12 | |
| 2.0.0 | 19 / 12 | |
| 1.0.0 | 22 / 12 | |
| 0.1.1 | 11 / 7 | |
| 0.1.0 | 12 / 7 | |
| 0.0.0 | 0 / 0 |