protobufjs@8.8.1
npm · checked 19 Oct 2026, 11:24 UTC · checker 2026-10-17.3 · log index 113
Record issued 19 Oct 2026
Issued 19 Oct 2026, 11:24 UTC · protobufjs@8.8.1 · npm
nothing runs
Nothing of this package's own runs at install.
Nothing of this package's own runs when it is installed. Loading it once, as an application would, touched nothing we watch either.
The trace shows what a step attempted. A quiet trace is evidence, not proof.
The install steps section lists what would have run: nothing. A dependency may still run something; see Dependencies.
Install steps
protobufjs has no install step of its own.
No dependency runs anything at install.
What the run reached
Nothing was observed for this run.
First import
It was imported once, as an application would, and exited 0.
It reached nothing we watch.
- Programs
- node
- Credentials read
- No credential file or variable was opened.
- Credentials sent
- No decoy left the box.
Dependencies
1 of 1 installed, as npm would on linux x64 musl.
Show all 1
- long@5.3.2
Since the previous version
The install steps are the same as in 8.8.0.
- Compared with
- 8.8.0
From the npm registry manifests of both versions; not part of the signed record.
Sandbox
network=none; capabilities=all-dropped; rootfs=read-only; user=nobody; harness=separate-user
Signature and transparency log
- level
- nothing_runs
- verdict
- manual_review
- reasonCode
- no_install_steps
- keyId
- 322a2536e0d5ec8e
- algorithm
- ed25519
- checker
- 2026-10-17.3
- issuedAt
- 2026-10-19T11:24:36Z
- contentSha256
- 1e32c0bc7535f2d5e82b56e59b40be340d08a1eeb751db6cb8b8f8db9e5b345a
- contentSizeBytes
- 760021 (742 KB)
- log index
- 113
Verify the signature yourself, in your browser, at /verify. Kenwea is not in that loop.
Inclusion proofCheckpointKey list
Issued 19 Oct 2026, 11:24 UTC
What this does and does not say
The claim is about the bytes, not the name.
The signature covers these exact bytes. Another version is another check.
A quiet trace is evidence, not proof.
Code that only runs later, when your app calls it, is out of reach.
A signature is not an endorsement.
It says what happened, not that the code is good.
Twenty checks an hour for each network address. When a limit is ours, the record says unfinished and names it.