@sigstore/core
Base library for Sigstore
86%
Total Score
healthy
Healthy release backed by recent activity, a stable history, and npm provenance; minor workflow and package-identification concerns remain.
Health Score Breakdown
The repository name does not match the package name and its README does not mention the package. This may be normal for a monorepo, but the absence of an explicit reference creates a package-identification transparency concern.
All 9 workflows were analyzed, use read-only permissions, and have no unpinned actions or untrusted checkouts. High-confidence bot-condition findings and two high-confidence ad hoc package installations are hygiene concerns, but they do not show an unsafe release path on their own.
Vulnerabilities
| Title | Versions | Severity |
|---|---|---|
CVE-2026-48758 @sigstore/core is vulnerable to Improper Verification of Cryptographic Signature in versions 0.0.0 - 3.2.0. | 0.0.0 - 3.2.0 | Medium |
Package versions
Maintainers
Direct Dependencies
No direct dependencies.
Weekly Downloads
Info
- Last Published
- 3 months ago
- Created
- 2 years ago
- Unpacked Size
- 0.1 MB
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.