nx@24.0.3
npm · checked 30 Oct 2026, 20:45 UTC · checker 2026-10-30.3 · log index 1091
Record issued 30 Oct 2026
Issued 30 Oct 2026, 20:45 UTC · nx@24.0.3 · npm
quiet
Its install steps ran with decoy credentials in reach and touched nothing we watch.
Its install steps ran here, with decoy credentials in reach, and touched nothing we watch: no network, no credential files. That is evidence, not proof: code can wait for a different machine or run later, when it is used.
The trace shows what a step attempted. A quiet trace is evidence, not proof.
Install steps
nx runs this install step of its own:
- postinstall
No dependency runs anything at install.
What the install steps reached
No install step reached anything we watch.
- Programs
- node
- Credentials read
- No credential file or variable was opened.
- Credentials sent
- No decoy left the box.
- Looked for
- git
The record keeps what all the install steps reached together; it does not say which step did which.
First import
It was imported once, as an application would, and exited 1.
It reached nothing we watch.
- Programs
- node
- Credentials read
- No credential file or variable was opened.
- Credentials sent
- No decoy left the box.
- Looked for
- git
loading it exited 1; many libraries need configuration or a host to load, so this says little either way
Dependencies
90 of 90 installed, as npm would on linux x64 musl.
Show all 90
- @clack/core@1.4.3
- @clack/prompts@1.7.0
- @emnapi/core@1.4.5
- @emnapi/runtime@1.4.5
- @emnapi/wasi-threads@1.0.4
- @jest/diff-sequences@30.0.1
- @napi-rs/wasm-runtime@0.2.4
- @nx/nx-linux-x64-gnu@24.0.3
- @nx/nx-linux-x64-musl@24.0.3
- @tybys/wasm-util@0.9.0
- @yarnpkg/lockfile@1.1.0
- @zkochan/js-yaml@0.0.7
- ansi-regex@5.0.1
- ansi-styles@4.3.0
- argparse@2.0.1
- balanced-match@4.0.3
- base64-js@1.5.1
- bl@4.1.0
- brace-expansion@5.0.12
- buffer@5.7.1
- chalk@4.1.2
- cli-cursor@3.1.0
- cli-spinners@2.6.1
- cliui@8.0.1
- clone@1.0.4
- color-convert@2.0.1
- color-name@1.1.4
- defaults@1.0.4
- dotenv-expand@12.0.3
- dotenv@16.4.7
- ejs@5.0.1
- emoji-regex@8.0.0
- end-of-stream@1.4.5
- escalade@3.2.0
- escape-string-regexp@1.0.5
- fast-string-truncated-width@3.0.3
- fast-string-width@3.0.2
- fast-wrap-ansi@0.2.0
- figures@3.2.0
- fs-constants@1.0.0
- get-caller-file@2.0.5
- has-flag@4.0.0
- ieee754@1.2.1
- ignore@7.0.12
- inherits@2.0.4
- is-fullwidth-code-point@3.0.0
- is-interactive@1.0.0
- is-unicode-supported@0.1.0
- isexe@2.0.0
- json5@2.2.3
- jsonc-parser@3.3.1
- lines-and-columns@2.0.3
- log-symbols@4.1.0
- mimic-fn@2.1.0
- minimatch@10.2.5
- minimist@1.2.8
- npm-run-path@4.0.1
- once@1.4.0
- onetime@5.1.2
- ora@5.4.1
- path-key@3.1.1
- picocolors@1.1.1
- readable-stream@3.6.2
- require-directory@2.1.1
- resolve.exports@2.0.3
- restore-cursor@3.1.0
- safe-buffer@5.2.1
- semver@7.8.5
- signal-exit@3.0.7
- sisteransi@1.0.5
- smol-toml@1.9.0
- string-width@4.2.3
- string_decoder@1.3.0
- strip-ansi@6.0.1
- strip-bom@3.0.0
- supports-color@7.2.0
- tar-stream@2.2.0
- tmp@0.2.7
- tsconfig-paths@4.2.0
- tslib@2.8.1
- undici@7.30.1
- util-deprecate@1.0.2
- wcwidth@1.0.1
- which@3.0.1
- wrap-ansi@7.0.0
- wrappy@1.0.2
- y18n@5.0.8
- yaml@2.9.0
- yargs-parser@21.1.1
- yargs@17.7.2
Since the previous version
The install steps are the same as in 24.0.2.
- Compared with
- 24.0.2
From the npm registry manifests of both versions; not part of the signed record.
How it was published: Published the same way as 24.0.2.
What it did, compared with the record of 24.0.2
It did the same things as 24.0.2 in the sandbox. The two records were made by different checker versions (2026-10-19.2 for 24.0.2, 2026-10-30.3 for this one), so a difference may come from the checker rather than the package.
- Level
- quiet
A comparison of the notary's signed records of both versions, made when this page is read; not part of either signature. A difference is a lead, not a verdict: two runs can differ for the sandbox's reasons too.
Sandbox
network=none; capabilities=all-dropped; rootfs=read-only; user=nobody; harness=separate-user
The kernel tracer attached every probe before the steps started and saw 3971 events across 3 traced steps, with none lost.
image sha256:affcfb39dcdfcd08dedf907b2ab5f89da46fc2ddbf1a237f2e498f03d892c208
Signature and transparency log
- level
- quiet
- verdict
- approved
- reasonCode
- ran_ok
- keyId
- 322a2536e0d5ec8e
- algorithm
- ed25519
- checker
- 2026-10-30.3
- issuedAt
- 2026-10-30T20:45:46Z
- contentSha256
- 7b28f6421f8547ebf1437655e903e25ac781e961e7068e40c3d0f6dcb76a0e1f
- contentSizeBytes
- 5849072 (5.6 MB)
- outputSha256
- d54b0a9db66ced4d248f95e6bf8877d950a56dbf386f4bdb353aef62cc9826f3
- log index
- 1091
Verify the signature yourself, in your browser, at /verify. Kenwea is not in that loop.
Inclusion proofCheckpointKey list
Issued 30 Oct 2026, 20:45 UTC
What this does and does not say
The claim is about the bytes, not the name.
The signature covers these exact bytes. Another version is another check.
A quiet trace is evidence, not proof.
Code that only runs later, when your app calls it, is out of reach.
A signature is not an endorsement.
It says what happened, not that the code is good.
Twenty checks an hour for each network address. When a limit is ours, the record says unfinished and names it.