workerd@1.20261027.1
npm · checked 27 Oct 2026, 01:36 UTC · checker 2026-10-19.2 · log index 1030
Record issued 27 Oct 2026
Issued 27 Oct 2026, 01:36 UTC · workerd@1.20261027.1 · npm
unfinished
The check could not finish. This is not a pass.
The check could not finish (step_timed_out), so this is not a pass.
The trace shows what a step attempted. A quiet trace is evidence, not proof.
An unfinished check is not a pass. Nothing here says the package is quiet.
Install steps
workerd runs this install step of its own:
- postinstall
No dependency runs anything at install.
What the install steps reached
- DNS
- registry.npmjs.org
- Requests
- TLS to registry.npmjs.org:443 (1595 bytes sent, encrypted)
- Programs
- node, npm
- Credentials read
- No credential file or variable was opened.
- Credentials sent
- No decoy left the box.
The record keeps what all the install steps reached together; it does not say which step did which.
First import
No first import was recorded for this check.
Dependencies
The dependency tree was installed.
the dependencies were not installed and their install steps were not run: @cloudflare/workerd-linux-64@1.20261027.1: HTTP 404
Since the previous version
The install steps are the same as in 1.20261026.1.
- Compared with
- 1.20261026.1
From the npm registry manifests of both versions; not part of the signed record.
What it did, compared with the record of 1.20261026.1
Since 1.20261026.1: level quiet in 1.20261026.1, now unfinished; first reaches registry.npmjs.org; starts npm for the first time. The check of this version did not finish, so what it reached is what a step did before our time limit stopped it, and that alone is not counted as a change of the package.
- Level
- quiet → unfinished
- First reached
- registry.npmjs.org
- Programs started
- npm
A comparison of the notary's signed records of both versions, made when this page is read; not part of either signature. A difference is a lead, not a verdict: two runs can differ for the sandbox's reasons too.
Sandbox
network=none; capabilities=all-dropped; rootfs=read-only; user=nobody; harness=separate-user
Signature and transparency log
- level
- unfinished
- verdict
- manual_review
- reasonCode
- step_timed_out
- keyId
- 322a2536e0d5ec8e
- algorithm
- ed25519
- checker
- 2026-10-19.2
- issuedAt
- 2026-10-27T01:36:34Z
- contentSha256
- 1535a24c40e9b7114e677ccdc8ca0feb31f916816c8a488527ea14545676e4bc
- contentSizeBytes
- 1287428 (1.2 MB)
- outputSha256
- 25348f0294d965da23c509d9de62289ac119880b98d76304cf8d4ddb25abd817
- log index
- 1030
Verify the signature yourself, in your browser, at /verify. Kenwea is not in that loop.
Inclusion proofCheckpointKey list
Issued 27 Oct 2026, 01:36 UTC
What this does and does not say
The claim is about the bytes, not the name.
The signature covers these exact bytes. Another version is another check.
A quiet trace is evidence, not proof.
Code that only runs later, when your app calls it, is out of reach.
A signature is not an endorsement.
It says what happened, not that the code is good.
Twenty checks an hour for each network address. When a limit is ours, the record says unfinished and names it.