Is @enactprotocol/trust safe to use?

@enactprotocol/trust has no known vulnerabilities on the latest version (2.3.8). DepScope rates its health at 54/100 (high risk).

What is the latest version of @enactprotocol/trust?

The latest version of @enactprotocol/trust is 2.3.8, released 2026-02-21.

Does @enactprotocol/trust have known vulnerabilities?

No known vulnerabilities on the latest version of @enactprotocol/trust.

Is @enactprotocol/trust deprecated?

No, @enactprotocol/trust is actively maintained. Latest release: 2.3.8 (2026-02-21).

What are alternatives to @enactprotocol/trust?

Popular alternatives to @enactprotocol/trust in npm include: ?, ansi-styles, brace-expansion, semver, ms.

What license does @enactprotocol/trust use?

@enactprotocol/trust is licensed under Apache-2.0.

@enactprotocol/trust

npmv2.3.8

Sigstore integration, attestations, and verification for Enact

License Apache-2.0permissive43 versions1 maintainers10 deps

/ 100

Health

use with caution

@enactprotocol/[email protected] low health (54/100) — consider alternatives

Moderate health score (54/100) — verify manually

Health breakdown0 – 100

15/25

maintenance

0/20

popularity

25/25

security

12/15

maturity

2/15

community

Vulnerabilities

none known

Bundle & TypeScript

🌟

TypeScript

10/10typed

bundled

Health History

Dependency Tree

License Audit

Dependencies (10)

open openid-client @enactprotocol/sigstore @enactprotocol/sigstore-bundle @enactprotocol/sigstore-sign @enactprotocol/sigstore-verify @enactprotocol/sigstore-core @enactprotocol/sigstore-tuf @sigstore/protobuf-specs @sigstore/rekor-types

API access

Get this data programmatically — free, no authentication.

curl https://depscope.dev/api/check/npm/@enactprotocol/trust