Is @sigstore/core safe to use?

@sigstore/core has no known vulnerabilities on the latest version (3.2.0). DepScope rates its health at 72/100 (moderate risk).

What is the latest version of @sigstore/core?

The latest version of @sigstore/core is 3.2.0, released 2026-03-18.

Does @sigstore/core have known vulnerabilities?

No known vulnerabilities on the latest version of @sigstore/core.

Is @sigstore/core deprecated?

No, @sigstore/core is actively maintained. Latest release: 3.2.0 (2026-03-18).

What are alternatives to @sigstore/core?

Popular alternatives to @sigstore/core in npm include: minimatch, wrap-ansi, @types/node, eslint-visitor-keys, ajv.

What license does @sigstore/core use?

@sigstore/core is licensed under Apache-2.0.

@sigstore/core

npmv3.2.0

Base library for Sigstore

License Apache-2.0permissive8 versions1 maintainers0 deps7,666,275 weekly dl

sigstore/sigstore-js

/ 100

Health

safe to use

@sigstore/[email protected] is safe to use (health: 72/100)

Health breakdown0 – 100

20/25

maintenance

17/20

popularity

25/25

security

6/15

maturity

4/15

community

Vulnerabilities

none known

Bundle & TypeScript

📦

Bundle Size

24.3 KBminified

5.8 KB gzipped

0 direct dependencies

side effectsscoped

🌟

TypeScript

10/10typed

bundled

Quality signals

Publish security

npm signed

Health History

Dependency Tree

License Audit

API access

Get this data programmatically — free, no authentication.

curl https://depscope.dev/api/check/npm/@sigstore/core