read-file-stdin
Read from a file, falling back to stdin.
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| provenance | no-provenance | AI (provenance): Package is 12+ years old; lack of provenance is expected for packages predating Sigstore. Not a meaningful risk signal for this package. | ai | |
| npm-metadata | url-dep:concat-stream | AI (npm-metadata): Git URL dependency on the legitimate upstream concat-stream repo is a historical artifact of this very old package (v0.0.1 from 2012-era npm practices), not a malicious signal. | ai | |
| provenance | publisher-changed | AI (provenance): Repository URL in package.json points to ianstormtaylor's GitHub namespace, confirming this is a legitimate maintainer transition, not a compromise. | ai | |
| publish-pattern | dormant-publish | AI (publish-pattern): Dormancy is consistent with a planned ownership transfer to ianstormtaylor, a well-established publisher. No malicious signals in the diff. | ai |
Versions (showing 6 of 6)
| Version | Deps | Published |
|---|---|---|
| 0.2.1 | 1 / 1 | |
| 0.2.0 | 1 / 1 | |
| 0.0.4 | 1 / 1 | |
| 0.0.3 | 1 / 1 | |
| 0.0.2 | 1 / 1 | |
| 0.0.1 | 1 / 1 |
v0.2.1
2 findingsThis version was published by a different npm account than previous versions on 2016-01-21. This could indicate a legitimate maintainer transition or an account compromise.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.2.0
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2014-10-15. This could indicate a legitimate maintainer transition or an account compromise.
v0.0.4
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.3
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.