Gathering detailed insights and metrics for @chainsafe/lodestar-config
Gathering detailed insights and metrics for @chainsafe/lodestar-config
🌟 Ethereum Consensus client for the Zig and TypeScript ecosystem
Installations
npm install @chainsafe/lodestar-configDeveloper Guide
BETA
Typescript
Yes
Module System
ESM
Node Version
16.15.1
NPM Version
lerna/4.0.0/node@v16.15.1+x64 (linux)
Releases
203
Release v1.32.0-rc.0
v1.32.0-rc.0
Updated on Jul 09, 2025
Release v1.31.0
v1.31.0
Updated on Jun 03, 2025
Release v1.31.0-rc.1
v1.31.0-rc.1
Updated on Jun 03, 2025
Release v1.31.0-rc.0
v1.31.0-rc.0
Updated on May 30, 2025
Release v1.30.0
v1.30.0
Updated on May 14, 2025
Release v1.30.0-rc.0
v1.30.0-rc.0
Updated on May 09, 2025
Languages
4
TypeScript
JavaScript
Shell
Dockerfile
TypeScript (98.87%)
JavaScript (0.71%)
Shell (0.36%)
Dockerfile (0.07%)
Developer
Download Statistics
Total Downloads
0
Last Day
0
Last Week
0
Last Month
0
Last Year
0
GitHub Statistics
Apache-2.0 License
1,298 Stars
10,471 Commits
384 Forks
34 Watchers
421 Branches
133 Contributors
Updated on Jul 14, 2025
Maintainers
5
Package Meta Information
Latest Version
0.39.0
Package Id
@chainsafe/lodestar-config@0.39.0
Unpacked Size
69.29 kB
Size
18.28 kB
File Count
66
NPM Version
lerna/4.0.0/node@v16.15.1+x64 (linux)
Node Version
16.15.1
Total Downloads
Cumulative downloads
Total Downloads
NaN
Last Day
0%
NaN
Compared to previous day
Last Week
0%
NaN
Compared to previous week
Last Month
0%
NaN
Compared to previous month
Last Year
0%
NaN
Compared to previous year
Weekly Downloads
Monthly Downloads
Yearly Downloads
lodestar-config
This package is part of ChainSafe's Lodestar project
Lodestar defines all network configuration variables defined in the Ethereum Consensus spec. This tooling may be used to configure testnets, ingest mainnet/testnet config variables, or be used in downstream Lodestar libraries.
Installation
1npm install @chainsafe/lodestar-config
Usage
The Lodestar config package contains several interfaces used in downstream Lodestar libraries:
IChainConfig- Typescript interface, Default (mainnet) values, and matching SSZ helper type objectIForkConfig- A fork helper object that's structured around the fork scheduleIChainForkConfigA wrapper object that implementsIChainConfigandIForkConfigICachedGenesis- A helper object for caching domains (which relies on the genesis validators root)IBeaconConfig- A wrapper object that implements all above interfaces
Chain config
The Ethereum consensus spec defines a bunch of variables that may be easily configured per testnet. These include the GENESIS_TIME, SECONDS_PER_SLOT, and various *_FORK_EPOCHs, *_FORK_VERSIONs, etc. The Lodestar config package exports the IChainConfig interface and matching ChainConfig SSZ type, which include all of these variables, named verbatim from the spec.
1import {IChainConfig} from "@chainsafe/lodestar-config"; 2import {chainConfig} from "@chainsafe/lodestar-config/default"; 3 4let config: IChainConfig = chainConfig; 5const x: number = config.SECONDS_PER_SLOT;
Mainnet default values are available as a singleton IChainConfig under the default import path.
1import {chainConfig} from "@chainsafe/lodestar-config/default"; 2 3chainConfig.SECONDS_PER_SLOT === 12;
There are also utility functions to help create a IChainConfig from unknown input and partial configs.
1import {createIChainConfig, IChainConfig, chainConfigFromJson} from "@chainsafe/lodestar-config"; 2 3// example config 4let chainConfigObj: Record<string, unknown> = { 5 // phase0 6 MIN_PER_EPOCH_CHURN_LIMIT: 4, 7 CHURN_LIMIT_QUOTIENT: 65536, 8 MIN_GENESIS_ACTIVE_VALIDATOR_COUNT: 128, 9 MIN_GENESIS_TIME: 1621504614, 10 ETH1_FOLLOW_DISTANCE: 2048, 11 SECONDS_PER_ETH1_BLOCK: 14, 12 DEPOSIT_CHAIN_ID: 5, 13 DEPOSIT_NETWORK_ID: 5, 14 DEPOSIT_CONTRACT_ADDRESS: "0x2cc88381fe23027743c1f85512bffb383acca7c7", 15 EJECTION_BALANCE: 16000000000, 16 GENESIS_FORK_VERSION: "0x00004811", 17 GENESIS_DELAY: 1100642, 18 SECONDS_PER_SLOT: 12, 19 MIN_VALIDATOR_WITHDRAWABILITY_DELAY: 256, 20 SHARD_COMMITTEE_PERIOD: 256, 21 22 // altair 23 INACTIVITY_SCORE_BIAS: 4, 24 INACTIVITY_SCORE_RECOVERY_RATE: 16, 25 ALTAIR_FORK_VERSION: "0x01004811", 26 ALTAIR_FORK_EPOCH: 10, 27}; 28 29const partialChainConfig: Partial<IChainConfig> = chainConfigFromJson(chainConfigObj); 30 31// Fill in the missing values with mainnet default values 32const chainConfig: IChainConfig = createIChainConfig(partialChainConfig);
Fork config
The variables described in the spec can be used to assemble a more structured 'fork schedule'. This info is organized as IForkConfig in the Lodestar config package. In practice, the IChainConfig and IForkConfig are usually combined as a IChainForkConfig.
A IForkConfig provides methods to select the fork info, fork name, fork version, or fork ssz types given a slot.
1import {GENESIS_SLOT} from "@chainsafe/lodestar-params"; 2import {createIChainForkConfig, IChainForkConfig} from "@chainsafe/lodestar-config"; 3import {config as chainConfig} from "@chainsafe/lodestar-config/default"; 4 5const config: IChainForkConfig = createIChainForkConfig(chainConfig); 6 7const version = config.getForkVersion(GENESIS_SLOT);
Cached genesis
For signing Ethereum consensus objects, a cryptographic "domain" is computed and mixed into the signed message. This domain separates signatures made for the Ethereum mainnet from testnets or other instances of the chain. The ICachedGenesis interface is used to provide a cache for this purpose. Practically, the domain rarely changes, only per-fork, and so the value can be easily cached. Since the genesis validators root is part of the domain, it is required input to instantiate an ICachedGenesis. In practice, the IChainForkConfig and ICachedGenesis are usually combined as a IBeaconConfig. This is the 'highest level' object exported by the Lodestar config library.
1import {DOMAIN_DEPOSIT, GENESIS_SLOT} from "@chainsafe/lodestar-params"; 2import {createIBeaconConfig, IBeaconConfig} from "@chainsafe/lodestar-config"; 3import {config as chainConfig} from "@chainsafe/lodestar-config/default"; 4 5// dummy test root 6let genesisValidatorsRoot: Uint8Array = new Uint8Array(); 7 8const config: IBeaconConfig = createIBeaconConfig(chainConfig, genesisValidatorsRoot); 9 10const domain = config.getDomain(DOMAIN_DEPOSIT, GENESIS_SLOT);
License
Apache-2.0 ChainSafe Systems
No vulnerabilities found.
Reason
30 commit(s) and 17 issue activity found in the last 90 days -- score normalized to 10
Reason
security policy file detected
Details
- Info: security policy file detected: SECURITY.md:1
- Info: Found linked content: SECURITY.md:1
- Info: Found disclosure, vulnerability, and/or timelines in security policy: SECURITY.md:1
- Info: Found text in security policy: SECURITY.md:1
Reason
all changesets reviewed
Reason
no dangerous workflow patterns detected
Reason
license file detected
Details
- Info: project has a license file: LICENSE:0
- Info: FSF or OSI recognized license: Apache License 2.0: LICENSE:0
Reason
no binaries found in the repo
Reason
packaging workflow detected
Details
- Info: Project packages its releases by way of GitHub Actions.: .github/workflows/publish-dev.yml:107
Reason
SAST tool is run on all commits
Details
- Info: SAST configuration detected: CodeQL
- Info: all commits (30) are checked with a SAST tool
Reason
no effort to earn an OpenSSF best practices badge detected
Reason
detected GitHub workflow tokens with excessive permissions
Details
- Info: jobLevel 'contents' permission set to 'read': .github/workflows/codeql-analysis.yml:38
- Info: jobLevel 'actions' permission set to 'read': .github/workflows/codeql-analysis.yml:37
- Warn: no topLevel permission defined: .github/workflows/benchmark.yml:1
- Warn: no topLevel permission defined: .github/workflows/binaries.yml:1
- Warn: no topLevel permission defined: .github/workflows/build-debug-node.yml:1
- Warn: no topLevel permission defined: .github/workflows/codeql-analysis.yml:1
- Warn: no topLevel permission defined: .github/workflows/docs-check.yml:1
- Warn: no topLevel permission defined: .github/workflows/docs.yml:1
- Warn: no topLevel permission defined: .github/workflows/kurtosis.yml:1
- Warn: no topLevel permission defined: .github/workflows/lint-pr-title.yml:1
- Warn: no topLevel permission defined: .github/workflows/publish-dev.yml:1
- Warn: no topLevel permission defined: .github/workflows/publish-rc.yml:1
- Warn: no topLevel permission defined: .github/workflows/publish-stable.yml:1
- Warn: no topLevel permission defined: .github/workflows/test-sim-merge.yml:1
- Warn: no topLevel permission defined: .github/workflows/test-sim.yml:1
- Warn: no topLevel permission defined: .github/workflows/test.yml:1
- Info: no jobLevel write permissions found
Reason
Project has not signed or included provenance with any releases.
Details
- Warn: release artifact v1.32.0-rc.0 not signed: https://api.github.com/repos/ChainSafe/lodestar/releases/231245580
- Warn: release artifact v1.31.0 not signed: https://api.github.com/repos/ChainSafe/lodestar/releases/222889568
- Warn: release artifact v1.31.0-rc.1 not signed: https://api.github.com/repos/ChainSafe/lodestar/releases/222873211
- Warn: release artifact v1.31.0-rc.0 not signed: https://api.github.com/repos/ChainSafe/lodestar/releases/222120479
- Warn: release artifact v1.30.0 not signed: https://api.github.com/repos/ChainSafe/lodestar/releases/218608333
- Warn: release artifact v1.32.0-rc.0 does not have provenance: https://api.github.com/repos/ChainSafe/lodestar/releases/231245580
- Warn: release artifact v1.31.0 does not have provenance: https://api.github.com/repos/ChainSafe/lodestar/releases/222889568
- Warn: release artifact v1.31.0-rc.1 does not have provenance: https://api.github.com/repos/ChainSafe/lodestar/releases/222873211
- Warn: release artifact v1.31.0-rc.0 does not have provenance: https://api.github.com/repos/ChainSafe/lodestar/releases/222120479
- Warn: release artifact v1.30.0 does not have provenance: https://api.github.com/repos/ChainSafe/lodestar/releases/218608333
Reason
project is not fuzzed
Details
- Warn: no fuzzer integrations found
Reason
dependency not pinned by hash detected -- score normalized to 0
Details
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/benchmark.yml:33: update your workflow using https://app.stepsecurity.io/secureworkflow/ChainSafe/lodestar/benchmark.yml/unstable?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/benchmark.yml:34: update your workflow using https://app.stepsecurity.io/secureworkflow/ChainSafe/lodestar/benchmark.yml/unstable?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/benchmark.yml:43: update your workflow using https://app.stepsecurity.io/secureworkflow/ChainSafe/lodestar/benchmark.yml/unstable?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/benchmark.yml:60: update your workflow using https://app.stepsecurity.io/secureworkflow/ChainSafe/lodestar/benchmark.yml/unstable?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/binaries.yml:30: update your workflow using https://app.stepsecurity.io/secureworkflow/ChainSafe/lodestar/binaries.yml/unstable?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/binaries.yml:52: update your workflow using https://app.stepsecurity.io/secureworkflow/ChainSafe/lodestar/binaries.yml/unstable?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/binaries.yml:58: update your workflow using https://app.stepsecurity.io/secureworkflow/ChainSafe/lodestar/binaries.yml/unstable?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build-debug-node.yml:21: update your workflow using https://app.stepsecurity.io/secureworkflow/ChainSafe/lodestar/build-debug-node.yml/unstable?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build-debug-node.yml:47: update your workflow using https://app.stepsecurity.io/secureworkflow/ChainSafe/lodestar/build-debug-node.yml/unstable?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql-analysis.yml:50: update your workflow using https://app.stepsecurity.io/secureworkflow/ChainSafe/lodestar/codeql-analysis.yml/unstable?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql-analysis.yml:54: update your workflow using https://app.stepsecurity.io/secureworkflow/ChainSafe/lodestar/codeql-analysis.yml/unstable?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql-analysis.yml:67: update your workflow using https://app.stepsecurity.io/secureworkflow/ChainSafe/lodestar/codeql-analysis.yml/unstable?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql-analysis.yml:80: update your workflow using https://app.stepsecurity.io/secureworkflow/ChainSafe/lodestar/codeql-analysis.yml/unstable?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/docs-check.yml:15: update your workflow using https://app.stepsecurity.io/secureworkflow/ChainSafe/lodestar/docs-check.yml/unstable?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/docs-check.yml:16: update your workflow using https://app.stepsecurity.io/secureworkflow/ChainSafe/lodestar/docs-check.yml/unstable?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/docs-check.yml:24: update your workflow using https://app.stepsecurity.io/secureworkflow/ChainSafe/lodestar/docs-check.yml/unstable?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/docs-check.yml:50: update your workflow using https://app.stepsecurity.io/secureworkflow/ChainSafe/lodestar/docs-check.yml/unstable?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/docs.yml:28: update your workflow using https://app.stepsecurity.io/secureworkflow/ChainSafe/lodestar/docs.yml/unstable?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/docs.yml:32: update your workflow using https://app.stepsecurity.io/secureworkflow/ChainSafe/lodestar/docs.yml/unstable?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/docs.yml:43: update your workflow using https://app.stepsecurity.io/secureworkflow/ChainSafe/lodestar/docs.yml/unstable?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/docs.yml:70: update your workflow using https://app.stepsecurity.io/secureworkflow/ChainSafe/lodestar/docs.yml/unstable?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/kurtosis.yml:14: update your workflow using https://app.stepsecurity.io/secureworkflow/ChainSafe/lodestar/kurtosis.yml/unstable?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/kurtosis.yml:18: update your workflow using https://app.stepsecurity.io/secureworkflow/ChainSafe/lodestar/kurtosis.yml/unstable?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/kurtosis.yml:25: update your workflow using https://app.stepsecurity.io/secureworkflow/ChainSafe/lodestar/kurtosis.yml/unstable?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/lint-pr-title.yml:17: update your workflow using https://app.stepsecurity.io/secureworkflow/ChainSafe/lodestar/lint-pr-title.yml/unstable?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/publish-dev.yml:18: update your workflow using https://app.stepsecurity.io/secureworkflow/ChainSafe/lodestar/publish-dev.yml/unstable?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/publish-dev.yml:21: update your workflow using https://app.stepsecurity.io/secureworkflow/ChainSafe/lodestar/publish-dev.yml/unstable?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/publish-dev.yml:31: update your workflow using https://app.stepsecurity.io/secureworkflow/ChainSafe/lodestar/publish-dev.yml/unstable?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/publish-dev.yml:112: update your workflow using https://app.stepsecurity.io/secureworkflow/ChainSafe/lodestar/publish-dev.yml/unstable?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/publish-dev.yml:115: update your workflow using https://app.stepsecurity.io/secureworkflow/ChainSafe/lodestar/publish-dev.yml/unstable?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/publish-dev.yml:118: update your workflow using https://app.stepsecurity.io/secureworkflow/ChainSafe/lodestar/publish-dev.yml/unstable?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/publish-dev.yml:120: update your workflow using https://app.stepsecurity.io/secureworkflow/ChainSafe/lodestar/publish-dev.yml/unstable?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/publish-rc.yml:18: update your workflow using https://app.stepsecurity.io/secureworkflow/ChainSafe/lodestar/publish-rc.yml/unstable?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/publish-rc.yml:58: update your workflow using https://app.stepsecurity.io/secureworkflow/ChainSafe/lodestar/publish-rc.yml/unstable?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/publish-rc.yml:70: update your workflow using https://app.stepsecurity.io/secureworkflow/ChainSafe/lodestar/publish-rc.yml/unstable?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/publish-rc.yml:77: update your workflow using https://app.stepsecurity.io/secureworkflow/ChainSafe/lodestar/publish-rc.yml/unstable?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/publish-rc.yml:117: update your workflow using https://app.stepsecurity.io/secureworkflow/ChainSafe/lodestar/publish-rc.yml/unstable?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/publish-rc.yml:131: update your workflow using https://app.stepsecurity.io/secureworkflow/ChainSafe/lodestar/publish-rc.yml/unstable?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/publish-rc.yml:135: update your workflow using https://app.stepsecurity.io/secureworkflow/ChainSafe/lodestar/publish-rc.yml/unstable?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/publish-rc.yml:138: update your workflow using https://app.stepsecurity.io/secureworkflow/ChainSafe/lodestar/publish-rc.yml/unstable?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/publish-rc.yml:140: update your workflow using https://app.stepsecurity.io/secureworkflow/ChainSafe/lodestar/publish-rc.yml/unstable?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/publish-stable.yml:18: update your workflow using https://app.stepsecurity.io/secureworkflow/ChainSafe/lodestar/publish-stable.yml/unstable?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/publish-stable.yml:64: update your workflow using https://app.stepsecurity.io/secureworkflow/ChainSafe/lodestar/publish-stable.yml/unstable?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/publish-stable.yml:76: update your workflow using https://app.stepsecurity.io/secureworkflow/ChainSafe/lodestar/publish-stable.yml/unstable?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/publish-stable.yml:83: update your workflow using https://app.stepsecurity.io/secureworkflow/ChainSafe/lodestar/publish-stable.yml/unstable?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/publish-stable.yml:107: update your workflow using https://app.stepsecurity.io/secureworkflow/ChainSafe/lodestar/publish-stable.yml/unstable?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/publish-stable.yml:121: update your workflow using https://app.stepsecurity.io/secureworkflow/ChainSafe/lodestar/publish-stable.yml/unstable?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/publish-stable.yml:131: update your workflow using https://app.stepsecurity.io/secureworkflow/ChainSafe/lodestar/publish-stable.yml/unstable?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/publish-stable.yml:135: update your workflow using https://app.stepsecurity.io/secureworkflow/ChainSafe/lodestar/publish-stable.yml/unstable?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/publish-stable.yml:138: update your workflow using https://app.stepsecurity.io/secureworkflow/ChainSafe/lodestar/publish-stable.yml/unstable?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/publish-stable.yml:140: update your workflow using https://app.stepsecurity.io/secureworkflow/ChainSafe/lodestar/publish-stable.yml/unstable?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test-sim-merge.yml:29: update your workflow using https://app.stepsecurity.io/secureworkflow/ChainSafe/lodestar/test-sim-merge.yml/unstable?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test-sim-merge.yml:55: update your workflow using https://app.stepsecurity.io/secureworkflow/ChainSafe/lodestar/test-sim-merge.yml/unstable?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test-sim.yml:100: update your workflow using https://app.stepsecurity.io/secureworkflow/ChainSafe/lodestar/test-sim.yml/unstable?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test-sim.yml:118: update your workflow using https://app.stepsecurity.io/secureworkflow/ChainSafe/lodestar/test-sim.yml/unstable?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test-sim.yml:129: update your workflow using https://app.stepsecurity.io/secureworkflow/ChainSafe/lodestar/test-sim.yml/unstable?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test-sim.yml:147: update your workflow using https://app.stepsecurity.io/secureworkflow/ChainSafe/lodestar/test-sim.yml/unstable?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test-sim.yml:158: update your workflow using https://app.stepsecurity.io/secureworkflow/ChainSafe/lodestar/test-sim.yml/unstable?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test-sim.yml:176: update your workflow using https://app.stepsecurity.io/secureworkflow/ChainSafe/lodestar/test-sim.yml/unstable?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test-sim.yml:31: update your workflow using https://app.stepsecurity.io/secureworkflow/ChainSafe/lodestar/test-sim.yml/unstable?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test-sim.yml:42: update your workflow using https://app.stepsecurity.io/secureworkflow/ChainSafe/lodestar/test-sim.yml/unstable?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test-sim.yml:60: update your workflow using https://app.stepsecurity.io/secureworkflow/ChainSafe/lodestar/test-sim.yml/unstable?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test-sim.yml:71: update your workflow using https://app.stepsecurity.io/secureworkflow/ChainSafe/lodestar/test-sim.yml/unstable?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test-sim.yml:89: update your workflow using https://app.stepsecurity.io/secureworkflow/ChainSafe/lodestar/test-sim.yml/unstable?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test.yml:76: update your workflow using https://app.stepsecurity.io/secureworkflow/ChainSafe/lodestar/test.yml/unstable?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test.yml:97: update your workflow using https://app.stepsecurity.io/secureworkflow/ChainSafe/lodestar/test.yml/unstable?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test.yml:104: update your workflow using https://app.stepsecurity.io/secureworkflow/ChainSafe/lodestar/test.yml/unstable?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/test.yml:120: update your workflow using https://app.stepsecurity.io/secureworkflow/ChainSafe/lodestar/test.yml/unstable?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test.yml:137: update your workflow using https://app.stepsecurity.io/secureworkflow/ChainSafe/lodestar/test.yml/unstable?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test.yml:159: update your workflow using https://app.stepsecurity.io/secureworkflow/ChainSafe/lodestar/test.yml/unstable?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test.yml:174: update your workflow using https://app.stepsecurity.io/secureworkflow/ChainSafe/lodestar/test.yml/unstable?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test.yml:197: update your workflow using https://app.stepsecurity.io/secureworkflow/ChainSafe/lodestar/test.yml/unstable?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test.yml:204: update your workflow using https://app.stepsecurity.io/secureworkflow/ChainSafe/lodestar/test.yml/unstable?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test.yml:25: update your workflow using https://app.stepsecurity.io/secureworkflow/ChainSafe/lodestar/test.yml/unstable?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test.yml:47: update your workflow using https://app.stepsecurity.io/secureworkflow/ChainSafe/lodestar/test.yml/unstable?enable=pin
- Warn: containerImage not pinned by hash: Dockerfile:4
- Warn: containerImage not pinned by hash: Dockerfile:24
- Warn: containerImage not pinned by hash: Dockerfile:38: pin your Docker image by updating node:22-slim to node:22-slim@sha256:b04ce4ae4e95b522112c2e5c52f781471a5cbc3b594527bcddedee9bc48c03a0
- Warn: containerImage not pinned by hash: Dockerfile.dev:6
- Warn: containerImage not pinned by hash: docker/grafana/Dockerfile:4: pin your Docker image by updating grafana/grafana:8.5.27 to grafana/grafana:8.5.27@sha256:b43abed8a2b8c5a4055c3729d77ae11c9646c4b9feefb5c136b7c67dcdad21c0
- Warn: containerImage not pinned by hash: docker/grafana_dev/Dockerfile:4: pin your Docker image by updating grafana/grafana:8.5.16 to grafana/grafana:8.5.16@sha256:af7bb7926e211b37cfdc728f7aae91856dfad835eb9714a75992ab84cfb2adca
- Warn: containerImage not pinned by hash: docker/prometheus/Dockerfile:1: pin your Docker image by updating prom/prometheus:latest to prom/prometheus:latest@sha256:7a34573f0b9c952286b33d537f233cd5b708e12263733aa646e50c33f598f16c
- Info: 0 out of 55 GitHub-owned GitHubAction dependencies pinned
- Info: 0 out of 20 third-party GitHubAction dependencies pinned
- Info: 0 out of 7 containerImage dependencies pinned
Reason
40 existing vulnerabilities detected
Details
- Warn: Project is vulnerable to: GHSA-968p-4wvh-cqc8
- Warn: Project is vulnerable to: GHSA-v6h2-p8h4-qcjw
- Warn: Project is vulnerable to: GHSA-grv7-fg5c-xmjg
- Warn: Project is vulnerable to: GHSA-pxg6-pf52-xh8x
- Warn: Project is vulnerable to: GHSA-vhxf-7vqr-mrjg
- Warn: Project is vulnerable to: GHSA-f7f6-9jq7-3rqj
- Warn: Project is vulnerable to: GHSA-4www-5p9h-95mh
- Warn: Project is vulnerable to: GHSA-9gqv-wp59-fq42
- Warn: Project is vulnerable to: GHSA-m5qc-5hw7-8vg7
- Warn: Project is vulnerable to: GHSA-cg87-wmx4-v546
- Warn: Project is vulnerable to: GHSA-rhx6-c78j-4q9w
- Warn: Project is vulnerable to: GHSA-9wv6-86v2-598j
- Warn: Project is vulnerable to: GHSA-x7hr-w5r2-h6wg
- Warn: Project is vulnerable to: GHSA-4v9v-hfq4-rm2v
- Warn: Project is vulnerable to: GHSA-9jgg-88mc-972h
- Warn: Project is vulnerable to: GHSA-x4c5-c7rf-jjgv
- Warn: Project is vulnerable to: GHSA-h5c3-5r3r-rr8q
- Warn: Project is vulnerable to: GHSA-rmvr-2pp2-xj38
- Warn: Project is vulnerable to: GHSA-xx4v-prfh-6cgc
- Warn: Project is vulnerable to: GHSA-3gc7-fjrx-p6mg
- Warn: Project is vulnerable to: GHSA-3xgq-45jj-v275
- Warn: Project is vulnerable to: GHSA-6r2x-8pq8-9489
- Warn: Project is vulnerable to: GHSA-434g-2637-qmqr
- Warn: Project is vulnerable to: GHSA-49q7-c7j4-3p7m
- Warn: Project is vulnerable to: GHSA-977x-g7h5-7qgw
- Warn: Project is vulnerable to: GHSA-f7q4-pwc6-w24p
- Warn: Project is vulnerable to: GHSA-fc9h-whq2-v747
- Warn: Project is vulnerable to: GHSA-vjh7-7g9h-fjfh
- Warn: Project is vulnerable to: GHSA-67mh-4wv8-2f99
- Warn: Project is vulnerable to: GHSA-75v8-2h7p-7m2m
- Warn: Project is vulnerable to: GHSA-2p57-rm9w-gvfp
- Warn: Project is vulnerable to: GHSA-35jh-r3h4-6jhm
- Warn: Project is vulnerable to: GHSA-h7cp-r72f-jxh6
- Warn: Project is vulnerable to: GHSA-v62p-rq8g-8h59
- Warn: Project is vulnerable to: GHSA-f5x3-32g6-xq36
- Warn: Project is vulnerable to: GHSA-pq67-2wwv-3xjx
- Warn: Project is vulnerable to: GHSA-8cj5-5rvv-wf4v
- Warn: Project is vulnerable to: GHSA-cxrh-j4jr-qwg3
- Warn: Project is vulnerable to: GHSA-3h5v-q93c-6h6q
- Warn: Project is vulnerable to: GHSA-776f-qx25-q3cc
Score
5.9
/10
Last Scanned on 2025-07-14
The Open Source Security Foundation is a cross-industry collaboration to improve the security of open source software (OSS). The Scorecard provides security health metrics for open source projects.
Learn More