zipkin Apache-2.0 2 versions

zipkin

npm Repository Homepage

The core tracer for Zipkin JS

Versions

Apache-2.0

License

Install Scripts

Missing

Provenance

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.

Maintainers

openzipkin

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
bogus-package	bogus-package	AI (bogus-package): openzipkin publishes a monorepo of zipkin-js packages with templated names — this is expected project structure, not spam production.	ai	2026/04/25
phantom-deps	phantom-dep:base64-js	AI (phantom-deps): Declared dependency that may be used indirectly or in config; not a security concern for this established package.	ai	2026/04/25
phantom-deps	phantom-dep:network-address	AI (phantom-deps): Declared dependency used in config/indirect context; legitimate utility for a tracing library needing host IP identification.	ai	2026/04/25

Versions (showing 2 of 2)

Version	Deps	Published
0.22.0	2 / 0	2020-06-04
0.10.1	2 / 3	2017-10-29

v0.22.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.10.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.