Gathering detailed insights and metrics for @sigstore/bundle
Gathering detailed insights and metrics for @sigstore/bundle
Installations
npm install @sigstore/bundleDeveloper Guide
BETA
Typescript
Yes
Module System
CommonJS
Min. Node Version
^18.17.0 || >=20.5.0
Node Version
18.17.0
NPM Version
10.9.2
Releases
139
@sigstore/tuf@3.1.1
@sigstore/tuf@3.1.1
Updated on Apr 25, 2025
@sigstore/cli@0.8.2
@sigstore/cli@0.8.2
Updated on Apr 25, 2025
@sigstore/verify@2.1.1
@sigstore/verify@2.1.1
Updated on Apr 25, 2025
@sigstore/oci@0.5.0
@sigstore/oci@0.5.0
Updated on Apr 25, 2025
@sigstore/tuf@3.1.0
@sigstore/tuf@3.1.0
Updated on Feb 04, 2025
@sigstore/verify@2.1.0
@sigstore/verify@2.1.0
Updated on Feb 04, 2025
Languages
5
TypeScript
JavaScript
Makefile
Shell
Batchfile
TypeScript (98.04%)
JavaScript (1.2%)
Makefile (0.67%)
Shell (0.08%)
Batchfile (0.01%)
Developer
sigstore
Download Statistics
Total Downloads
0
Last Day
0
Last Week
0
Last Month
0
Last Year
0
GitHub Statistics
Apache-2.0 License
165 Stars
1,142 Commits
31 Forks
6 Watchers
32 Branches
44 Contributors
Updated on Jul 04, 2025
Maintainers
2
Package Meta Information
Latest Version
3.1.0
Package Id
@sigstore/bundle@3.1.0
Unpacked Size
39.50 kB
Size
9.02 kB
File Count
17
NPM Version
10.9.2
Node Version
18.17.0
Published on
Feb 04, 2025
Total Downloads
Cumulative downloads
Total Downloads
NaN
Last Day
0%
NaN
Compared to previous day
Last Week
0%
NaN
Compared to previous week
Last Month
0%
NaN
Compared to previous month
Last Year
0%
NaN
Compared to previous year
Weekly Downloads
Monthly Downloads
Yearly Downloads
Dependencies
1
@sigstore/bundle · 
A JavaScript library for working with the Sigstore bundle format.
Features
- TypeScript types for the different Sigstore bundle versions.
- Bundle validation functions.
- Support for serializing/deserializing bundles to/from JSON.
Prerequisites
- Node.js version >= 18.17.0
Installation
npm install @sigstore/bundle
No vulnerabilities found.
Reason
update tool detected
Details
- Info: detected update tool: Dependabot: .github/dependabot.yml:1
Reason
all changesets reviewed
Reason
23 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Reason
GitHub workflow tokens follow principle of least privilege
Details
- Warn: jobLevel 'contents' permission set to 'write': .github/workflows/auto-merge.yml:14
- Info: jobLevel 'contents' permission set to 'read': .github/workflows/compatibility-check.yml:18
- Warn: jobLevel 'contents' permission set to 'write': .github/workflows/dependabot-changesets.yml:12
- Warn: jobLevel 'contents' permission set to 'write': .github/workflows/release.yml:18
- Info: jobLevel 'contents' permission set to 'read': .github/workflows/smoke-test.yml:18
- Info: jobLevel 'contents' permission set to 'read': .github/workflows/smoke-test.yml:53
- Info: jobLevel 'contents' permission set to 'read': .github/workflows/smoke-test.yml:106
- Warn: jobLevel 'contents' permission set to 'write': .github/workflows/update-tuf-seeds.yml:16
- Info: topLevel 'contents' permission set to 'read': .github/workflows/auto-merge.yml:8
- Info: topLevel 'contents' permission set to 'read': .github/workflows/ci.yml:10
- Info: topLevel 'contents' permission set to 'read': .github/workflows/compatibility-check.yml:11
- Info: topLevel 'contents' permission set to 'read': .github/workflows/conformance.yml:11
- Info: topLevel 'contents' permission set to 'read': .github/workflows/dependabot-changesets.yml:6
- Info: topLevel 'contents' permission set to 'read': .github/workflows/release.yml:11
- Info: topLevel permissions set to 'read-all': .github/workflows/scorecard.yml:18
- Info: topLevel 'contents' permission set to 'read': .github/workflows/smoke-test.yml:11
- Info: topLevel 'contents' permission set to 'read': .github/workflows/update-tuf-seeds.yml:10
Reason
no binaries found in the repo
Reason
no dangerous workflow patterns detected
Reason
license file detected
Details
- Info: project has a license file: LICENSE:0
- Info: FSF or OSI recognized license: Apache License 2.0: LICENSE:0
Reason
security policy file detected
Details
- Info: security policy file detected: github.com/sigstore/.github/SECURITY.md:1
- Info: Found linked content: github.com/sigstore/.github/SECURITY.md:1
- Info: Found disclosure, vulnerability, and/or timelines in security policy: github.com/sigstore/.github/SECURITY.md:1
- Info: Found text in security policy: github.com/sigstore/.github/SECURITY.md:1
Reason
0 existing vulnerabilities detected
Reason
dependency not pinned by hash detected -- score normalized to 8
Details
- Warn: npmCommand not pinned by hash: .github/workflows/compatibility-check.yml:30
- Warn: downloadThenRun not pinned by hash: .github/workflows/release.yml:34
- Info: 26 out of 26 GitHub-owned GitHubAction dependencies pinned
- Info: 6 out of 6 third-party GitHubAction dependencies pinned
- Info: 7 out of 8 npmCommand dependencies pinned
- Info: 0 out of 1 downloadThenRun dependencies pinned
Reason
branch protection is not maximal on development and all release branches
Details
- Info: 'allow deletion' disabled on branch 'main'
- Info: 'force pushes' disabled on branch 'main'
- Info: 'branch protection settings apply to administrators' is required to merge on branch 'main'
- Info: 'stale review dismissal' is required to merge on branch 'main'
- Warn: required approving review count is 1 on branch 'main'
- Info: codeowner review is required on branch 'main'
- Info: 'last push approval' is required to merge on branch 'main'
- Info: 'up-to-date branches' is required to merge on branch 'main'
- Info: status check found to merge onto on branch 'main'
- Info: PRs are required in order to make changes on branch 'main'
Reason
project has 2 contributing companies or organizations -- score normalized to 6
Details
- Info: found contributions from: github, sigstore
Reason
no effort to earn an OpenSSF best practices badge detected
Reason
project is not fuzzed
Details
- Warn: no fuzzer integrations found
Score
8.7
/10
Last Scanned on 2025-07-13T16:27:32Z
The Open Source Security Foundation is a cross-industry collaboration to improve the security of open source software (OSS). The Scorecard provides security health metrics for open source projects.
Learn More