Notary record

editly@0.14.2

npm · checked 21 Oct 2026, 23:19 UTC · checker 2026-10-19.2 · log index 954

Check againCheck another package

Record issued 21 Oct 2026

Issued 21 Oct 2026, 23:19 UTC · editly@0.14.2 · npm

unfinished

The check could not finish. This is not a pass.

The check could not finish (install_step_failed), so this is not a pass.

The trace shows what a step attempted. A quiet trace is evidence, not proof.

An unfinished check is not a pass. Nothing here says the package is quiet.

Check another package

Phases

This record does not state its phases one by one; npm records from checker 2026-11-03.1 and Python records from 2026-11-04.3 on do.

Install steps

editly has no install step of its own.

1 of its 332 dependencies run one:

  • canvas@2.11.2install

What the install steps reached

DNS
  • github.com
Requests
  • TLS to github.com:443 (1587 bytes sent, encrypted)
Programs
node, node-pre-gyp
Credentials read
No credential file or variable was opened.
Credentials sent
No decoy left the box.
Looked for
python, python3

The record keeps what all the install steps reached together; it does not say which step did which.

First import

No first import was recorded for this check.

Dependencies

332 of 332 installed, as npm would on linux x64 musl.

Show all 332
  • @babel/code-frame@7.29.7
  • @babel/helper-validator-identifier@7.29.7
  • @gar/promisify@1.1.3
  • @mapbox/node-pre-gyp@1.0.11
  • @npmcli/fs@2.1.2
  • @npmcli/move-file@2.0.1
  • @tokenizer/token@0.3.0
  • @tootallnate/once@2.0.1
  • @types/minimist@1.2.5
  • @types/normalize-package-data@2.4.4
  • abab@2.0.6
  • abbrev@1.1.1
  • abort-controller@3.0.0
  • acorn-globals@6.0.0
  • acorn-walk@7.2.0
  • acorn@7.4.1
  • acorn@8.19.0
  • add-line-numbers@1.0.1
  • agent-base@6.0.2
  • agentkeepalive@4.6.0
  • aggregate-error@3.1.0
  • aggregate-error@4.0.1
  • ansi-regex@5.0.1
  • aproba@2.1.0
  • are-we-there-yet@2.0.0
  • are-we-there-yet@3.0.1
  • arrify@1.0.1
  • asynckit@0.4.0
  • atob-lite@1.0.0
  • balanced-match@1.0.2
  • base64-js@1.5.1
  • bindings@1.5.0
  • bit-twiddle@1.0.2
  • bl@4.1.0
  • brace-expansion@1.1.21
  • brace-expansion@2.1.7
  • browser-process-hrtime@1.0.0
  • buffer@5.7.1
  • buffer@6.0.3
  • cacache@16.1.3
  • call-bind-apply-helpers@1.0.2
  • camelcase-keys@7.0.2
  • camelcase@6.3.0
  • canvas@2.11.2
  • chownr@1.1.4
  • chownr@2.0.0
  • clean-stack@2.2.0
  • clean-stack@4.2.0
  • color-support@1.1.3
  • combined-stream@1.0.8
  • compare-versions@4.1.4
  • concat-map@0.0.1
  • console-control-strings@1.1.0
  • core-util-is@1.0.3
  • cross-spawn@7.0.6
  • cssom@0.3.8
  • cssom@0.5.0
  • cssstyle@2.3.0
  • cwise-compiler@1.1.3
  • data-urls@3.0.2
  • debug@4.4.3
  • decamelize-keys@1.1.1
  • decamelize@1.2.0
  • decamelize@5.0.1
  • decimal.js@10.6.0
  • decompress-response@4.2.1
  • decompress-response@6.0.0
  • deep-extend@0.6.0
  • delayed-stream@1.0.0
  • delegates@1.0.0
  • detect-libc@2.1.2
  • domexception@4.0.0
  • dunder-proto@1.0.1
  • dup@1.0.0
  • emoji-regex@8.0.0
  • encoding@0.1.13
  • end-of-stream@1.4.5
  • env-paths@2.2.1
  • err-code@2.0.3
  • error-ex@1.3.4
  • es-define-property@1.0.1
  • es-errors@1.3.0
  • es-object-atoms@1.1.2
  • es-set-tostringtag@2.1.0
  • escape-string-regexp@5.0.0
  • escodegen@2.1.0
  • esprima@4.0.1
  • estraverse@5.3.0
  • esutils@2.0.3
  • event-target-shim@5.0.1
  • events@3.3.0
  • execa@6.1.0
  • expand-template@2.0.3
  • exponential-backoff@3.1.3
  • fabric@5.5.2
  • file-type@18.7.0
  • file-uri-to-path@1.0.0
  • file-url@4.0.0
  • find-up@5.0.0
  • form-data@4.0.6
  • fs-constants@1.0.0
  • fs-extra@10.1.0
  • fs-minipass@2.1.0
  • fs.realpath@1.0.0
  • function-bind@1.1.2
  • gauge@3.0.2
  • gauge@4.0.4
  • get-intrinsic@1.3.0
  • get-proto@1.0.1
  • get-stream@6.0.1
  • github-from-package@0.0.0
  • gl-buffer@2.1.2
  • gl-constants@1.0.0
  • gl-format-compiler-error@1.0.3
  • gl-shader@4.3.1
  • gl-texture2d@2.1.0
  • gl-transition@1.13.0
  • gl-transitions@1.76.1
  • gl@5.0.3
  • glob@7.2.3
  • glob@8.1.0
  • glsl-shader-name@1.0.0
  • glsl-tokenizer@2.1.5
  • gopd@1.2.0
  • graceful-fs@4.2.11
  • hard-rejection@2.1.0
  • has-symbols@1.1.0
  • has-tostringtag@1.0.2
  • has-unicode@2.0.1
  • hasown@2.0.4
  • hosted-git-info@4.1.0
  • html-encoding-sniffer@3.0.0
  • http-cache-semantics@4.3.0
  • http-proxy-agent@5.0.0
  • https-proxy-agent@5.0.1
  • human-signals@3.0.1
  • humanize-ms@1.2.1
  • iconv-lite@0.6.3
  • ieee754@1.2.1
  • imurmurhash@0.1.4
  • indent-string@4.0.0
  • indent-string@5.0.0
  • infer-owner@1.0.4
  • inflight@1.0.6
  • inherits@2.0.4
  • ini@1.3.8
  • iota-array@1.0.0
  • ip-address@10.7.4
  • is-arrayish@0.2.1
  • is-buffer@1.1.6
  • is-core-module@2.17.0
  • is-fullwidth-code-point@3.0.0
  • is-lambda@1.0.1
  • is-plain-obj@1.1.0
  • is-potential-custom-element-name@1.0.1
  • is-stream@3.0.0
  • isarray@0.0.1
  • isexe@2.0.0
  • js-tokens@4.0.0
  • jsdom@19.0.0
  • json-parse-even-better-errors@2.3.1
  • json5@2.2.3
  • jsonfile@6.2.1
  • kind-of@6.0.3
  • lines-and-columns@1.2.4
  • locate-path@6.0.0
  • lodash-es@4.18.1
  • lru-cache@6.0.0
  • lru-cache@7.18.3
  • make-dir@3.1.0
  • make-fetch-happen@10.2.1
  • map-obj@1.0.1
  • map-obj@4.3.0
  • math-intrinsics@1.1.0
  • meow@10.1.5
  • merge-stream@2.0.0
  • mime-db@1.52.0
  • mime-types@2.1.35
  • mimic-fn@4.0.0
  • mimic-response@2.1.0
  • mimic-response@3.1.0
  • minimatch@3.1.5
  • minimatch@5.1.9
  • minimist-options@4.1.0
  • minimist@1.2.8
  • minipass-collect@1.0.2
  • minipass-fetch@2.1.2
  • minipass-flush@1.0.7
  • minipass-pipeline@1.2.4
  • minipass-sized@1.0.3
  • minipass@3.3.6
  • minipass@3.3.6
  • minipass@3.3.6
  • minipass@3.3.6
  • minipass@3.3.6
  • minipass@3.3.6
  • minipass@3.3.6
  • minipass@3.3.6
  • minipass@3.3.6
  • minipass@3.3.6
  • and 132 more, in the JSON

Since the previous version

No comparison with an earlier version was made for this check.

Sandbox

Decoys presentStand-in networkTracer ebpf

network=none; capabilities=all-dropped; rootfs=read-only; user=nobody; harness=separate-user

Signature and transparency log

level
unfinished
verdict
manual_review
reasonCode
install_step_failed
keyId
322a2536e0d5ec8e
algorithm
ed25519
checker
2026-10-19.2
issuedAt
2026-10-21T23:19:38Z
contentSha256
87487bafae25c2fac59a21de935354e338d069b66b39e40a5e355ed2432820c4
contentSizeBytes
79007 (77 KB)
outputSha256
904ea33f3c1711f9e6002a8ad266760fe4c9efcf6315ad75d9f1ae04ba95f31c
log index
954

Verify the signature yourself, in your browser, at /verify. Kenwea is not in that loop.

Inclusion proofCheckpointKey list

Issued 21 Oct 2026, 23:19 UTC

What this does and does not say

The claim is about the bytes, not the name.

The signature covers these exact bytes. Another version is another check.

A quiet trace is evidence, not proof.

Code that only runs later, when your app calls it, is out of reach.

A signature is not an endorsement.

It says what happened, not that the code is good.

Twenty checks an hour for each network address. When a limit is ours, the record says unfinished and names it.

editly@0.14.2: unfinished. Kenwea notary | Kenwea Protocol