restify-clients

HttpClient, StringClient, and JsonClient extracted from restify

Supply chain provenance

Status for the latest visible version.

Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.

Maintainers

Keywords

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
dependencies	unvetted-dep:bunyan	AI (dependencies): bunyan is a well-known Node.js logging library, standard dependency for restify-family packages.	ai	2026/04/21
dependencies	unvetted-dep:backoff	AI (dependencies): backoff is a well-known retry/backoff utility, legitimate and widely used.	ai	2026/04/21
dependencies	unvetted-dep:restify-errors	AI (dependencies): restify-errors is the official error library from the restify project, expected dependency.	ai	2026/04/21
dependencies	unvetted-dep:dtrace-provider	AI (dependencies): dtrace-provider is an optional DTrace instrumentation dependency standard in restify-family packages.	ai	2026/04/21
dependencies	unvetted-dep:keep-alive-agent	AI (dependencies): keep-alive-agent is a small, well-known HTTP keep-alive utility, legitimate use in HTTP client library.	ai	2026/04/21
dependencies	unvetted-dep:fast-safe-stringify	AI (dependencies): fast-safe-stringify is a well-known safe JSON serialization utility, legitimate dependency.	ai	2026/04/21

Version	Deps	Published
4.2.0	15 / 16	2022-09-20