Notary record

nx@24.0.2

npm · checked 26 Oct 2026, 20:35 UTC · checker 2026-10-19.2 · log index 1028

Issued 26 Oct 2026, 20:35 UTC · nx@24.0.2 · npm

quiet

Its install steps ran with decoy credentials in reach and touched nothing we watch.

Its install steps ran here, with decoy credentials in reach, and touched nothing we watch: no network, no credential files. That is evidence, not proof: code can wait for a different machine or run later, when it is used.

The trace shows what a step attempted. A quiet trace is evidence, not proof.

Check another package

Install steps

nx runs this install step of its own:

postinstall

No dependency runs anything at install.

What the install steps reached

No install step reached anything we watch.

Programs: node
Credentials read: No credential file or variable was opened.
Credentials sent: No decoy left the box.
Looked for: git

The record keeps what all the install steps reached together; it does not say which step did which.

First import

It was imported once, as an application would, and exited 1.

It reached nothing we watch.

Programs: node
Credentials read: No credential file or variable was opened.
Credentials sent: No decoy left the box.
Looked for: git

loading it exited 1; many libraries need configuration or a host to load, so this says little either way

Dependencies

90 of 90 installed, as npm would on linux x64 musl.

Show all 90

@clack/core@1.4.3
@clack/prompts@1.7.0
@emnapi/core@1.4.5
@emnapi/runtime@1.4.5
@emnapi/wasi-threads@1.0.4
@jest/diff-sequences@30.0.1
@napi-rs/wasm-runtime@0.2.4
@nx/nx-linux-x64-gnu@24.0.2
@nx/nx-linux-x64-musl@24.0.2
@tybys/wasm-util@0.9.0
@yarnpkg/lockfile@1.1.0
@zkochan/js-yaml@0.0.7
ansi-regex@5.0.1
ansi-styles@4.3.0
argparse@2.0.1
balanced-match@4.0.3
base64-js@1.5.1
bl@4.1.0
brace-expansion@5.0.12
buffer@5.7.1
chalk@4.1.2
cli-cursor@3.1.0
cli-spinners@2.6.1
cliui@8.0.1
clone@1.0.4
color-convert@2.0.1
color-name@1.1.4
defaults@1.0.4
dotenv-expand@12.0.3
dotenv@16.4.7
ejs@5.0.1
emoji-regex@8.0.0
end-of-stream@1.4.5
escalade@3.2.0
escape-string-regexp@1.0.5
fast-string-truncated-width@3.0.3
fast-string-width@3.0.2
fast-wrap-ansi@0.2.0
figures@3.2.0
fs-constants@1.0.0
get-caller-file@2.0.5
has-flag@4.0.0
ieee754@1.2.1
ignore@7.0.12
inherits@2.0.4
is-fullwidth-code-point@3.0.0
is-interactive@1.0.0
is-unicode-supported@0.1.0
isexe@2.0.0
json5@2.2.3
jsonc-parser@3.3.1
lines-and-columns@2.0.3
log-symbols@4.1.0
mimic-fn@2.1.0
minimatch@10.2.5
minimist@1.2.8
npm-run-path@4.0.1
once@1.4.0
onetime@5.1.2
ora@5.4.1
path-key@3.1.1
picocolors@1.1.1
readable-stream@3.6.2
require-directory@2.1.1
resolve.exports@2.0.3
restore-cursor@3.1.0
safe-buffer@5.2.1
semver@7.8.5
signal-exit@3.0.7
sisteransi@1.0.5
smol-toml@1.9.0
string-width@4.2.3
string_decoder@1.3.0
strip-ansi@6.0.1
strip-bom@3.0.0
supports-color@7.2.0
tar-stream@2.2.0
tmp@0.2.7
tsconfig-paths@4.2.0
tslib@2.8.1
undici@7.29.0
util-deprecate@1.0.2
wcwidth@1.0.1
which@3.0.1
wrap-ansi@7.0.0
wrappy@1.0.2
y18n@5.0.8
yaml@2.9.0
yargs-parser@21.1.1
yargs@17.7.2

Since the previous version

The install steps are the same as in 24.0.1.

Compared with: 24.0.1

From the npm registry manifests of both versions; not part of the signed record.

What it did, compared with the record of 24.0.1

It did the same things as 24.0.1 in the sandbox.

Level: quiet

A comparison of the notary's signed records of both versions, made when this page is read; not part of either signature. A difference is a lead, not a verdict: two runs can differ for the sandbox's reasons too.

Sandbox

Decoys presentStand-in networkTracer ebpf

network=none; capabilities=all-dropped; rootfs=read-only; user=nobody; harness=separate-user

Signature and transparency log

level: quiet
verdict: approved
reasonCode: ran_ok
keyId: 322a2536e0d5ec8e
algorithm: ed25519
checker: 2026-10-19.2
issuedAt: 2026-10-26T20:35:33Z
contentSha256: 9ba1569ce277e9180a42d38d5206dccc548ae3413a9be75941c37189d917845e
contentSizeBytes: 5847271 (5.6 MB)
outputSha256: a27a72ca5b1623d90a1990edc55f56ffd6c9a4142d7a6e58110d4923c7650569
log index: 1028

Verify the signature yourself, in your browser, at /verify. Kenwea is not in that loop.

Inclusion proof Checkpoint Key list

What this does and does not say

The claim is about the bytes, not the name.

The signature covers these exact bytes. Another version is another check.

A quiet trace is evidence, not proof.

Code that only runs later, when your app calls it, is out of reach.

A signature is not an endorsement.

It says what happened, not that the code is good.

Twenty checks an hour for each network address. When a limit is ours, the record says unfinished and names it.