Notary record

create-t3-app@7.40.0

npm · checked 21 Oct 2026, 23:17 UTC · checker 2026-10-19.2 · log index 946

Check againCheck another package

Record issued 21 Oct 2026

Issued 21 Oct 2026, 23:17 UTC · create-t3-app@7.40.0 · npm

network

An install step tried to reach the network. Find out why before installing.

Loading it tried to reach the network (DNS registry.npmjs.org, TLS to registry.npmjs.org:443 (1595 bytes sent, encrypted)), before your code called anything. Find out why before using it.

The trace shows what a step attempted. A quiet trace is evidence, not proof.

Check another package

Phases

This record does not state its phases one by one; npm records from checker 2026-11-03.1 and Python records from 2026-11-04.3 on do.

Install steps

create-t3-app has no install step of its own.

No dependency runs anything at install.

What the run reached

Nothing was observed for this run.

First import

It was imported once, as an application would, and exited 124.

DNS
  • registry.npmjs.org
Requests
  • TLS to registry.npmjs.org:443 (1595 bytes sent, encrypted)
Programs
node, npm
Credentials read
No credential file or variable was opened.
Credentials sent
No decoy left the box.

loading it exited 124; many libraries need configuration or a host to load, so this says little either way

Dependencies

93 of 93 installed, as npm would on linux x64 musl.

Show all 93
  • @babel/code-frame@7.29.7
  • @babel/generator@7.29.8
  • @babel/helper-globals@7.29.7
  • @babel/helper-string-parser@7.29.7
  • @babel/helper-validator-identifier@7.29.7
  • @babel/parser@7.29.9
  • @babel/template@7.29.7
  • @babel/traverse@7.29.10
  • @babel/types@7.29.8
  • @clack/core@0.3.5
  • @clack/prompts@0.6.3
  • @ianvs/prettier-plugin-sort-imports@4.7.1
  • @jridgewell/gen-mapping@0.3.13
  • @jridgewell/resolve-uri@3.1.2
  • @jridgewell/sourcemap-codec@1.6.0
  • @jridgewell/trace-mapping@0.3.31
  • @types/tinycolor2@1.4.6
  • ansi-regex@6.4.0
  • ansi-styles@4.3.0
  • base64-js@1.5.1
  • bl@5.1.0
  • buffer@6.0.3
  • chalk@4.1.2
  • chalk@5.2.0
  • cli-cursor@4.0.0
  • cli-spinners@2.9.2
  • clone@1.0.4
  • color-convert@2.0.1
  • color-name@1.1.4
  • commander@10.0.1
  • cross-spawn@7.0.6
  • debug@4.4.3
  • defaults@1.0.4
  • detect-indent@7.0.2
  • detect-newline@4.0.1
  • execa@7.2.0
  • fdir@6.5.0
  • fs-extra@11.4.1
  • get-stdin@9.0.0
  • get-stream@6.0.1
  • git-hooks-list@3.2.0
  • graceful-fs@4.2.11
  • gradient-string@2.0.2
  • has-flag@4.0.0
  • human-signals@4.3.1
  • ieee754@1.2.1
  • inherits@2.0.4
  • is-interactive@2.0.0
  • is-plain-obj@4.1.0
  • is-stream@3.0.0
  • is-unicode-supported@1.3.0
  • is-unicode-supported@1.3.0
  • is-unicode-supported@2.1.0
  • isexe@2.0.0
  • js-tokens@4.0.0
  • jsesc@3.1.0
  • jsonfile@6.2.1
  • log-symbols@5.1.0
  • merge-stream@2.0.0
  • mimic-fn@2.1.0
  • mimic-fn@4.0.0
  • ms@2.1.3
  • npm-run-path@5.3.0
  • onetime@5.1.2
  • onetime@6.0.0
  • ora@6.3.1
  • path-key@3.1.1
  • path-key@4.0.0
  • picocolors@1.1.1
  • picomatch@4.0.7
  • prettier@3.9.10
  • readable-stream@3.6.2
  • restore-cursor@4.0.0
  • safe-buffer@5.2.1
  • semver@7.8.5
  • shebang-command@2.0.0
  • shebang-regex@3.0.0
  • signal-exit@3.0.7
  • sisteransi@1.0.5
  • sort-object-keys@1.1.3
  • sort-package-json@2.15.1
  • stdin-discarder@0.1.0
  • string_decoder@1.3.0
  • strip-ansi@7.2.0
  • strip-final-newline@3.0.0
  • supports-color@7.2.0
  • tinycolor2@1.6.0
  • tinyglobby@0.2.17
  • tinygradient@1.1.5
  • universalify@2.0.1
  • util-deprecate@1.0.2
  • wcwidth@1.0.1
  • which@2.0.2

Since the previous version

No comparison with an earlier version was made for this check.

Sandbox

Decoys presentStand-in networkTracer ebpf

network=none; capabilities=all-dropped; rootfs=read-only; user=nobody; harness=separate-user

Signature and transparency log

level
network
verdict
manual_review
reasonCode
load_tried_network
keyId
322a2536e0d5ec8e
algorithm
ed25519
checker
2026-10-19.2
issuedAt
2026-10-21T23:17:36Z
contentSha256
20dcd9e03b1cc5997c128d3e966687f961d79cd054bbc4c30ee907102562092b
contentSizeBytes
65824 (64 KB)
log index
946

Verify the signature yourself, in your browser, at /verify. Kenwea is not in that loop.

Inclusion proofCheckpointKey list

Issued 21 Oct 2026, 23:17 UTC

What this does and does not say

The claim is about the bytes, not the name.

The signature covers these exact bytes. Another version is another check.

A quiet trace is evidence, not proof.

Code that only runs later, when your app calls it, is out of reach.

A signature is not an endorsement.

It says what happened, not that the code is good.

Twenty checks an hour for each network address. When a limit is ours, the record says unfinished and names it.