Notary · weekly
What changed at install this week
Every new version of the npm packages Kenwea watches is installed in a sandbox as it is published and compared with the version before it: the hosts it reached, the decoy credentials it opened, the install steps in its tree.
25 Oct 2026 to 1 Nov 2026 · 25 versions · 1 changed · 24 the same · 0 not compared yet
Changed (1)
The same as the version before (24)
- workerd@1.20261101.1quiet · compared with 1.20261031.1 · checked 1 Nov 2026It did the same things as 1.20261031.1 in the sandbox.Publish: Published the same way as 1.20261031.1.
- esbuild@0.28.2quiet · compared with 0.28.1 · checked 31 Oct 2026It did the same things as 0.28.1 in the sandbox. The two records were made by different checker versions (2026-10-16.2 for 0.28.1, 2026-10-30.3 for this one), so a difference may come from the checker rather than the package.Publish: Published the same way as 0.28.1.Source: 5 of the package's 7 files are not in github.com/evanw/esbuild at commit 609683d89297. Build output such as dist/ is usually most of these. A file an install step runs is not in the source: install.js. Many packages build theirs at release; whether this one always has is what the previous version shows.
- koffi@3.3.6quiet · compared with 3.3.5 · checked 31 Oct 2026It did the same things as 3.3.5 in the sandbox. The two records were made by different checker versions (2026-10-19.2 for 3.3.5, 2026-10-30.3 for this one), so a difference may come from the checker rather than the package.Publish: Published the same way as 3.3.5.Source: Not compared: npm recorded no commit for this version, and the repository has no tag named v3.3.6 or 3.3.6.
- @swc/core@1.16.21quiet · compared with 1.16.20 · checked 31 Oct 2026It did the same things as 1.16.20 in the sandbox. The two records were made by different checker versions (2026-10-19.2 for 1.16.20, 2026-10-30.3 for this one), so a difference may come from the checker rather than the package.Publish: Published the same way as 1.16.20.Source: 10 of the package's 14 files are not in github.com/swc-project/swc at tag v1.16.21, directory packages/core. Build output such as dist/ is usually most of these. A file an install step runs differs from the source: postinstall.js. It may be built at release; whether it always has been is what the previous version shows. npm recorded no commit for this version, so nothing ties it to a commit; the tag was used, and a tag can be moved after a release.
- @anthropic-ai/claude-code@2.1.316quiet · compared with 2.1.315 · checked 31 Oct 2026It did the same things as 2.1.315 in the sandbox.Publish: Published the same way as 2.1.315.
- workerd@1.20261031.1quiet · compared with 1.20261030.1 · checked 31 Oct 2026It did the same things as 1.20261030.1 in the sandbox. The two records were made by different checker versions (2026-10-19.2 for 1.20261030.1, 2026-10-30.3 for this one), so a difference may come from the checker rather than the package.Publish: Published the same way as 1.20261030.1.
- nx@24.0.3quiet · compared with 24.0.2 · checked 30 Oct 2026It did the same things as 24.0.2 in the sandbox. The two records were made by different checker versions (2026-10-19.2 for 24.0.2, 2026-10-30.3 for this one), so a difference may come from the checker rather than the package.Publish: Published the same way as 24.0.2.
- utf-8-validate@6.0.6quiet · compared with 6.0.5 · checked 30 Oct 2026It did the same things as 6.0.5 in the sandbox.Publish: Published the same way as 6.0.5.
- bufferutil@4.1.0quiet · compared with 4.0.9 · checked 30 Oct 2026It did the same things as 4.0.9 in the sandbox.Publish: Published the same way as 4.0.9.
- workerd@1.20261024.1quiet · compared with 1.20261023.1 · checked 30 Oct 2026It did the same things as 1.20261023.1 in the sandbox.Publish: Published the same way as 1.20261023.1.
- @anthropic-ai/claude-code@2.1.314quiet · compared with 2.1.312 · checked 30 Oct 2026It did the same things as 2.1.312 in the sandbox.Publish: Published the same way as 2.1.312.
- workerd@1.20261030.1quiet · compared with 1.20261029.1 · checked 30 Oct 2026It did the same things as 1.20261029.1 in the sandbox.Publish: Published the same way as 1.20261029.1.
- @pnpm/exe@12.16.1quiet · compared with 12.16.0 · checked 29 Oct 2026It did the same things as 12.16.0 in the sandbox.Publish: Published the same way as 12.16.0.
- pnpm@12.16.1quiet · compared with 12.16.0 · checked 29 Oct 2026It did the same things as 12.16.0 in the sandbox.Publish: Published the same way as 12.16.0.
- @google/genai@2.32.0quiet · compared with 2.31.0 · checked 29 Oct 2026It did the same things as 2.31.0 in the sandbox.Publish: Published the same way as 2.31.0.
- workerd@1.20261029.1quiet · compared with 1.20261028.1 · checked 29 Oct 2026It did the same things as 1.20261028.1 in the sandbox.Publish: Published the same way as 1.20261028.1.
- @modelcontextprotocol/inspector@2.13.0quiet · compared with 2.12.0 · checked 29 Oct 2026It did the same things as 2.12.0 in the sandbox.Publish: Published the same way as 2.12.0.
- koffi@3.3.5quiet · compared with 3.3.4 · checked 29 Oct 2026It did the same things as 3.3.4 in the sandbox.Publish: Published the same way as 3.3.4.Source: Not compared: npm recorded no commit for this version, and the repository has no tag named v3.3.5 or 3.3.5.
- workerd@1.20261028.1unfinished → quiet · compared with 1.20261027.1 · checked 28 Oct 2026Since 1.20261027.1: level unfinished in 1.20261027.1, now quiet.Publish: Published the same way as 1.20261027.1.
- @anthropic-ai/claude-code@2.1.312quiet · compared with 2.1.311 · checked 27 Oct 2026It did the same things as 2.1.311 in the sandbox.Publish: Published the same way as 2.1.311.
- workerd@1.20261027.1quiet → unfinished · compared with 1.20261026.1 · checked 27 Oct 2026Since 1.20261026.1: level quiet in 1.20261026.1, now unfinished; first reaches registry.npmjs.org; starts npm for the first time. The check of this version did not finish, so what it reached is what a step did before our time limit stopped it, and that alone is not counted as a change of the package.Publish: Published the same way as 1.20261026.1.
- @anthropic-ai/claude-code@2.1.311quiet · compared with 2.1.310 · checked 26 Oct 2026It did the same things as 2.1.310 in the sandbox.Publish: Published the same way as 2.1.310.
- nx@24.0.2quiet · compared with 24.0.1 · checked 26 Oct 2026It did the same things as 24.0.1 in the sandbox.Publish: Published the same way as 24.0.1.
- workerd@1.20261026.1quiet · compared with 1.20261025.1 · checked 26 Oct 2026It did the same things as 1.20261025.1 in the sandbox.Publish: Published the same way as 1.20261025.1.
New versions of the packages the notary watches (every package it has seen running something at install), checked as they were published. Each is compared with the notary's signed record of the version before it on the npm registry: the install steps the registry lists, and what each version did in the sandbox. A change is a lead, not a verdict; two runs can differ for the sandbox's reasons too, and the record page of each version says what was compared.