swagger-ui-express@5.0.1
npm · checked 19 Oct 2026, 21:16 UTC · checker 2026-10-19.2 · log index 126
Record issued 19 Oct 2026
Issued 19 Oct 2026, 21:16 UTC · swagger-ui-express@5.0.1 · npm
network
An install step tried to reach the network. Find out why before installing.
Its install steps tried to reach the network (DNS scarf.sh, TLS to scarf.sh:443 (1585 bytes sent, encrypted)). Nothing left the sandbox: a stand-in network inside it answered, and what was sent is listed. Find out why before installing.
The trace shows what a step attempted. A quiet trace is evidence, not proof.
Install steps
swagger-ui-express has no install step of its own.
1 of its 67 dependencies run one:
- @scarf/scarf@1.4.0postinstall
What the install steps reached
- DNS
- scarf.sh
- Requests
- TLS to scarf.sh:443 (1585 bytes sent, encrypted)
- Programs
- node, npm
- Credentials read
- No credential file or variable was opened.
- Credentials sent
- No decoy left the box.
The record keeps what all the install steps reached together; it does not say which step did which.
First import
It was imported once, as an application would, and exited 0.
It reached nothing we watch.
- Programs
- node
- Credentials read
- No credential file or variable was opened.
- Credentials sent
- No decoy left the box.
Dependencies
67 of 67 installed, as npm would on linux x64 musl.
Show all 67
- @scarf/scarf@1.4.0
- accepts@2.0.0
- body-parser@2.3.0
- bytes@3.1.2
- call-bind-apply-helpers@1.0.2
- call-bound@1.0.4
- content-disposition@2.0.1
- content-type@2.1.0
- cookie-signature@1.2.2
- cookie@0.7.2
- debug@4.4.3
- depd@2.0.0
- dunder-proto@1.0.1
- ee-first@1.1.1
- encodeurl@2.0.0
- es-define-property@1.0.1
- es-errors@1.3.0
- es-object-atoms@1.1.2
- escape-html@1.0.3
- etag@1.8.1
- express@5.3.0
- finalhandler@2.1.1
- forwarded@0.2.0
- fresh@2.0.0
- function-bind@1.1.2
- get-intrinsic@1.3.0
- get-proto@1.0.1
- gopd@1.2.0
- has-symbols@1.1.0
- hasown@2.0.4
- http-errors@2.0.1
- iconv-lite@0.7.3
- inherits@2.0.4
- ipaddr.js@1.9.1
- is-promise@4.0.0
- math-intrinsics@1.1.0
- media-typer@1.1.1
- merge-descriptors@2.0.0
- mime-db@1.54.0
- mime-types@3.0.2
- ms@2.1.3
- negotiator@1.1.0
- object-inspect@1.13.4
- on-finished@2.4.1
- once@1.4.0
- parseurl@1.3.3
- path-to-regexp@8.4.2
- proxy-addr@2.0.8
- qs@6.16.1
- range-parser@1.3.0
- raw-body@3.0.2
- router@2.2.0
- safer-buffer@2.1.2
- send@1.2.1
- serve-static@2.2.1
- setprototypeof@1.2.0
- side-channel-list@1.0.1
- side-channel-map@1.0.1
- side-channel-weakmap@1.0.2
- side-channel@1.1.1
- statuses@2.0.2
- swagger-ui-dist@5.34.0
- toidentifier@1.0.1
- type-is@2.1.0
- unpipe@1.0.0
- vary@1.1.2
- wrappy@1.0.2
Since the previous version
The install steps are the same as in 5.0.0.
- Compared with
- 5.0.0
From the npm registry manifests of both versions; not part of the signed record.
Sandbox
network=none; capabilities=all-dropped; rootfs=read-only; user=nobody; harness=separate-user
Signature and transparency log
- level
- network
- verdict
- manual_review
- reasonCode
- ran_tried_network
- keyId
- 322a2536e0d5ec8e
- algorithm
- ed25519
- checker
- 2026-10-19.2
- issuedAt
- 2026-10-19T21:16:18Z
- contentSha256
- 404855d4fc5e6cb1d88d8adcdbacfaefb029cbb3ed97de8ea5edb7ef2e25cd8b
- contentSizeBytes
- 7107 (7 KB)
- outputSha256
- 6486c462fa8a90c68ce5e37fd9ba11a9e24207bb92e828d4875be2917c9c321e
- log index
- 126
Verify the signature yourself, in your browser, at /verify. Kenwea is not in that loop.
Inclusion proofCheckpointKey list
Issued 19 Oct 2026, 21:16 UTC
What this does and does not say
The claim is about the bytes, not the name.
The signature covers these exact bytes. Another version is another check.
A quiet trace is evidence, not proof.
Code that only runs later, when your app calls it, is out of reach.
A signature is not an endorsement.
It says what happened, not that the code is good.
Twenty checks an hour for each network address. When a limit is ours, the record says unfinished and names it.