clearcutt-showcase estate
Image estate

Image

build-node:24

ghcr.io/northcutted/clearcutt-showcase/platform/build-node

Build image for Node.js 24 apps (stack node:1)

Meets every requirement in the policy.

Identity

Digest
sha256:b5aae0baa10365078fd9e7ef073333689935d6fc1935b254a87439bc5ba7ea20
Tags
24
Created
2026-10-16 00:00 UTC
Built by
clearcutt-factory (clearcutt-factory recipe)
Source
https://github.com/northcutted/clearcutt-showcase-platform at a61dd74b373c88f6d5efa00c8c9fa045834afadd Read from build provenance that verified.
clearcutt-factory
Image build-node; built with v0.3.0; pins 28 packages, 0 tools, 4 images; files clamped to 2026-10-16

Base

Built on
cgr.dev/chainguard/wolfi-base:latest
sha256:030e45cb37187dff322bbefe9658bcaec31b824a5d523380771a64864c9f45d4 (its linux/amd64 image)
How it's known
The image starts with the base's exact layer digests. This compares content, so it holds whatever the image says about itself. by layer digests, comparing the linux/amd64 images. The image starts with the base's exact layer digests. This compares content, so it holds whatever the image says about itself.
Currency
A newer version of its base was observed in this run. 1 version and 5 days behind
Newest observed: cgr.dev/chainguard/wolfi-base:latest sha256:e2d3af72b200 (its linux/amd64 image)
Measured against the newest version observed in this run, not against upstream.

Evidence

EvidenceStatusSigned byFound asWhenDetail
Signature Found, and checked against a trusted signer in the policy.https://github.com/northcutted/clearcutt-factory/.github/workflows/images.yml@refs/tags/v0.3.0
issuer https://token.actions.githubusercontent.com
run in https://github.com/northcutted/clearcutt-showcase-platform
cosign signature2026-10-17 13:57 UTC
ghcr.io/northcutted/clearcutt-showcase/platform/build-node@sha256:63264737507814536cd84123914fcf4399bd3e066ba2a87ad55088baa3ef71f8
SBOM Found, and checked against a trusted signer in the policy.https://github.com/northcutted/clearcutt-factory/.github/workflows/images.yml@refs/tags/v0.3.0
issuer https://token.actions.githubusercontent.com
run in https://github.com/northcutted/clearcutt-showcase-platform
cosign attestation2026-10-17 13:58 UTC
  • Found, and checked against a trusted signer in the policy.
  • Found, and checked against a trusted signer in the policy.
ghcr.io/northcutted/clearcutt-showcase/platform/build-node@sha256:f2ed6c90dde86a202d76c57a379e6af9ac546b39547114f7fdaeaef01b9a1290
Vulnerability report Found, and checked against a trusted signer in the policy.https://github.com/northcutted/clearcutt-factory/.github/workflows/images.yml@refs/tags/v0.3.0
issuer https://token.actions.githubusercontent.com
run in https://github.com/northcutted/clearcutt-showcase-platform
cosign attestation2026-10-17 13:59 UTC
  • Found, and checked against a trusted signer in the policy.
  • Found, and checked against a trusted signer in the policy.
ghcr.io/northcutted/clearcutt-showcase/platform/build-node@sha256:1d3c4d51ce38328c22392d9cf0d532c40fb660eaa70c890e98c39f782981ca11
SLSA provenance Found, and checked against a trusted signer in the policy.https://github.com/northcutted/clearcutt-factory/.github/workflows/images.yml@refs/tags/v0.3.0
issuer https://token.actions.githubusercontent.com
run in https://github.com/northcutted/clearcutt-showcase-platform
GitHub attestation2026-10-17 13:59 UTC
ghcr.io/northcutted/clearcutt-showcase/platform/build-node@sha256:9537e5253ec78f1ae6181f7deaf9ced0bf2696c30315812dffe58f7477c0b63f
Recipe Found, and checked against a trusted signer in the policy.https://github.com/northcutted/clearcutt-factory/.github/workflows/images.yml@refs/tags/v0.3.0
issuer https://token.actions.githubusercontent.com
run in https://github.com/northcutted/clearcutt-showcase-platform
cosign attestation2026-10-17 13:57 UTC
ghcr.io/northcutted/clearcutt-showcase/platform/build-node@sha256:760a6bd04ae225755d41c01acfcc47c8dcb8cf3f2e5fb33e2d2f592a765db94f
Rebase record Doesn't apply to this image.———No rebase record: the image was built, not rebased.
Tests The image's verified recipe declares a smoke test, which clearcutt-factory runs on every platform before it pushes, and it pushes nothing that fails. Nothing attests that the test ran, so it is a claim, not proof.—declared in the recipe—The verified recipe declares a smoke test (/bin/sh -c test "$(id -u)" = 65532 && node --version && npm --version) that clearcutt-factory runs on every platform before it pushes; the result isn't separately attested.

Check it yourself

Commands that check what this page says without trusting this site or the report: each signature and attestation the report says verified, against the signer the policy trusts, a rebuild, and the verdict. They name the image by its digest, ghcr.io/northcutted/clearcutt-showcase/platform/build-node@sha256:b5aae0baa10365078fd9e7ef073333689935d6fc1935b254a87439bc5ba7ea20, never by a tag that could move. Every value comes from the report and is quoted for a POSIX shell (sh, bash, zsh).

Signature. Checks the image's signature against the trusted signer.
cosign verify \
  --certificate-identity-regexp='^https://github\.com/northcutted/clearcutt-factory/\.github/workflows/(images|fleet)\.yml@refs/tags/v\d+\.\d+\.\d+$' \
  --certificate-oidc-issuer=https://token.actions.githubusercontent.com \
  --certificate-github-workflow-repository=northcutted/clearcutt-showcase-platform \
  --certificate-github-workflow-ref=refs/heads/main \
  ghcr.io/northcutted/clearcutt-showcase/platform/build-node@sha256:b5aae0baa10365078fd9e7ef073333689935d6fc1935b254a87439bc5ba7ea20
SBOM (linux/amd64). Checks the SBOM attestation was signed by the trusted signer, and prints it.
cosign verify-attestation \
  --type=https://cyclonedx.org/bom \
  --certificate-identity-regexp='^https://github\.com/northcutted/clearcutt-factory/\.github/workflows/(images|fleet)\.yml@refs/tags/v\d+\.\d+\.\d+$' \
  --certificate-oidc-issuer=https://token.actions.githubusercontent.com \
  --certificate-github-workflow-repository=northcutted/clearcutt-showcase-platform \
  --certificate-github-workflow-ref=refs/heads/main \
  ghcr.io/northcutted/clearcutt-showcase/platform/build-node@sha256:b6e82726ad9e94c0c4d8eae208a09295c631b405c18e7717c47afd814c92b6bb
SBOM (linux/arm64). Checks the SBOM attestation was signed by the trusted signer, and prints it.
cosign verify-attestation \
  --type=https://cyclonedx.org/bom \
  --certificate-identity-regexp='^https://github\.com/northcutted/clearcutt-factory/\.github/workflows/(images|fleet)\.yml@refs/tags/v\d+\.\d+\.\d+$' \
  --certificate-oidc-issuer=https://token.actions.githubusercontent.com \
  --certificate-github-workflow-repository=northcutted/clearcutt-showcase-platform \
  --certificate-github-workflow-ref=refs/heads/main \
  ghcr.io/northcutted/clearcutt-showcase/platform/build-node@sha256:92debff5e5c221ec2d7e1033b8236ad358b41855c6ae9caf3f4ce41d22a874b7
Vulnerability report (linux/amd64). Checks the vulnerability report was signed by the trusted signer, and prints it: the findings as of the day it was made.
cosign verify-attestation \
  --type=https://cosign.sigstore.dev/attestation/vuln/v1 \
  --certificate-identity-regexp='^https://github\.com/northcutted/clearcutt-factory/\.github/workflows/(images|fleet)\.yml@refs/tags/v\d+\.\d+\.\d+$' \
  --certificate-oidc-issuer=https://token.actions.githubusercontent.com \
  --certificate-github-workflow-repository=northcutted/clearcutt-showcase-platform \
  --certificate-github-workflow-ref=refs/heads/main \
  ghcr.io/northcutted/clearcutt-showcase/platform/build-node@sha256:b6e82726ad9e94c0c4d8eae208a09295c631b405c18e7717c47afd814c92b6bb
Vulnerability report (linux/arm64). Checks the vulnerability report was signed by the trusted signer, and prints it: the findings as of the day it was made.
cosign verify-attestation \
  --type=https://cosign.sigstore.dev/attestation/vuln/v1 \
  --certificate-identity-regexp='^https://github\.com/northcutted/clearcutt-factory/\.github/workflows/(images|fleet)\.yml@refs/tags/v\d+\.\d+\.\d+$' \
  --certificate-oidc-issuer=https://token.actions.githubusercontent.com \
  --certificate-github-workflow-repository=northcutted/clearcutt-showcase-platform \
  --certificate-github-workflow-ref=refs/heads/main \
  ghcr.io/northcutted/clearcutt-showcase/platform/build-node@sha256:92debff5e5c221ec2d7e1033b8236ad358b41855c6ae9caf3f4ce41d22a874b7
SLSA provenance. Checks the SLSA provenance was signed by the trusted signer, and prints it: what built the image, from which source.
cosign verify-attestation \
  --type=https://slsa.dev/provenance/v1 \
  --certificate-identity-regexp='^https://github\.com/northcutted/clearcutt-factory/\.github/workflows/(images|fleet)\.yml@refs/tags/v\d+\.\d+\.\d+$' \
  --certificate-oidc-issuer=https://token.actions.githubusercontent.com \
  --certificate-github-workflow-repository=northcutted/clearcutt-showcase-platform \
  --certificate-github-workflow-ref=refs/heads/main \
  ghcr.io/northcutted/clearcutt-showcase/platform/build-node@sha256:b5aae0baa10365078fd9e7ef073333689935d6fc1935b254a87439bc5ba7ea20
Recipe. Checks the clearcutt-factory recipe was signed by the trusted signer, and prints it.
cosign verify-attestation \
  --type=https://github.com/northcutted/clearcutt-factory/recipe/v1 \
  --certificate-identity-regexp='^https://github\.com/northcutted/clearcutt-factory/\.github/workflows/(images|fleet)\.yml@refs/tags/v\d+\.\d+\.\d+$' \
  --certificate-oidc-issuer=https://token.actions.githubusercontent.com \
  --certificate-github-workflow-repository=northcutted/clearcutt-showcase-platform \
  --certificate-github-workflow-ref=refs/heads/main \
  ghcr.io/northcutted/clearcutt-showcase/platform/build-node@sha256:b5aae0baa10365078fd9e7ef073333689935d6fc1935b254a87439bc5ba7ea20
SLSA provenance (GitHub). Checks GitHub's artifact attestation with GitHub's own verifier, reading it from the registry: made by a workflow run in that repository, signed by that workflow.
gh attestation verify \
  oci://ghcr.io/northcutted/clearcutt-showcase/platform/build-node@sha256:b5aae0baa10365078fd9e7ef073333689935d6fc1935b254a87439bc5ba7ea20 \
  --bundle-from-oci \
  --repo=northcutted/clearcutt-showcase-platform \
  --signer-workflow=github.com/northcutted/clearcutt-factory/.github/workflows/images.yml \
  --source-ref=refs/heads/main
Rebuild. Rebuilds the image from its signed recipe, without a cache, and checks that the rebuild has this digest. It needs Docker or Podman. clearcutt-factory takes no source-ref flag; the cosign commands above check the ref.
clearcutt-factory verify \
  --image=ghcr.io/northcutted/clearcutt-showcase/platform/build-node@sha256:b5aae0baa10365078fd9e7ef073333689935d6fc1935b254a87439bc5ba7ea20 \
  --certificate-identity-regexp='^https://github\.com/northcutted/clearcutt-factory/\.github/workflows/(images|fleet)\.yml@refs/tags/v\d+\.\d+\.\d+$' \
  --certificate-oidc-issuer=https://token.actions.githubusercontent.com \
  --certificate-github-workflow-repository=northcutted/clearcutt-showcase-platform
Verdict. Runs clearcutt-verify over this image alone, in a new directory, held to the policy this report was held to, and writes its own report to estate/estate-report.json. Its verdict should match this page's, though one image on its own can't show how far behind its base's newest version it is.
cd "$(mktemp -d)"
printf '%s\n' ghcr.io/northcutted/clearcutt-showcase/platform/build-node@sha256:b5aae0baa10365078fd9e7ef073333689935d6fc1935b254a87439bc5ba7ea20 > refs.txt
printf '%s\n' '{"apiVersion":"clearcutt.dev/v1","kind":"VerificationPolicy","required":["signature","sbom","vulnerabilityScan","provenance","recipe"],"trustedSigners":[{"identityRegexp":"^https://github\\.com/northcutted/clearcutt-factory/\\.github/workflows/(images|fleet)\\.yml@refs/tags/v\\d+\\.\\d+\\.\\d+$","issuer":"https://token.actions.githubusercontent.com","sourceRepository":"https://github.com/northcutted/clearcutt-showcase-platform","sourceRef":"refs/heads/main","sourceMatchesImage":true},{"identityRegexp":"^https://github\\.com/northcutted/clearcutt-factory/\\.github/workflows/(images|fleet)\\.yml@refs/tags/v\\d+\\.\\d+\\.\\d+$","issuer":"https://token.actions.githubusercontent.com","sourceRepository":"https://github.com/northcutted/clearcutt-showcase-checkout","sourceRef":"refs/heads/main","sourceMatchesImage":true},{"identityRegexp":"^https://github\\.com/northcutted/clearcutt-factory/\\.github/workflows/(images|fleet)\\.yml@refs/tags/v\\d+\\.\\d+\\.\\d+$","issuer":"https://token.actions.githubusercontent.com","sourceRepository":"https://github.com/northcutted/clearcutt-showcase-catalog","sourceRef":"refs/heads/main","sourceMatchesImage":true},{"identityRegexp":"^https://github\\.com/northcutted/clearcutt-factory/\\.github/workflows/(images|fleet)\\.yml@refs/tags/v\\d+\\.\\d+\\.\\d+$","issuer":"https://token.actions.githubusercontent.com","sourceRepository":"https://github.com/northcutted/clearcutt-showcase-storefront","sourceRef":"refs/heads/main","sourceMatchesImage":true}],"failOn":"critical","onlyFixed":true,"maxDaysBehind":7,"stackSigners":[{"identity":"https://github.com/northcutted/clearcutt-showcase-platform/.github/workflows/stacks.yml@refs/heads/main","issuer":"https://token.actions.githubusercontent.com"}]}' > policy.json
clearcutt-verify estate verify \
  --refs=refs.txt \
  --policy=policy.json \
  --platforms=linux/amd64,linux/arm64 \
  --out=estate

No command for Tests: it isn't verified, so there is no trusted signer to check it against.

Needs cosign, gh attestation, clearcutt-factory, clearcutt-verify, as of clearcutt-verify v0.16.0, which wrote this report.

Vulnerabilities

From the publisher's signed report (grype 0.118.0), made 2026-10-17 13:57 UTC, 1 day before this report. The findings describe that day. The report itself is Found, and checked against a trusted signer in the policy..

criticalhighmediumlownegligibleunknown
Findings0612100
With a fix0512100
19 findings

IDPackageVersionSeverityFixed inPlatforms
GHSA-6j4f-fj2g-mc7pbrace-expansion5.0.8high5.0.10linux/amd64, linux/arm64
GHSA-ch52-4w7c-c8xphttp-cache-semantics4.2.0highno fix knownlinux/amd64, linux/arm64
GHSA-mwp4-54f8-5fhrip-address10.2.0high10.3.1linux/amd64, linux/arm64
GHSA-qhr7-859c-m2p7brace-expansion5.0.8high5.0.11linux/amd64, linux/arm64
GHSA-rfgv-xxqx-mfg5undici6.27.0high6.28.1linux/amd64, linux/arm64
GHSA-rgw5-rvv9-x895brace-expansion5.0.8high5.0.9linux/amd64, linux/arm64
GHSA-22jq-vg5j-6vggip-address10.2.0medium10.2.1linux/amd64, linux/arm64
GHSA-2vr4-cq9g-pvrcip-address10.2.0medium10.5.1linux/amd64, linux/arm64
GHSA-3wwx-pv8p-q78vundici6.27.0medium6.28.1linux/amd64, linux/arm64
GHSA-4xrf-jv44-h6hhip-address10.2.0medium10.2.2linux/amd64, linux/arm64
GHSA-8xcm-r25x-g524undici6.27.0medium6.28.0linux/amd64, linux/arm64
GHSA-h3mg-xc3c-68pwip-address10.2.0medium10.7.1linux/amd64, linux/arm64
GHSA-j6r3-76f7-8jcvip-address10.2.0medium10.7.1linux/amd64, linux/arm64
GHSA-m8rv-5g2x-5cg5undici6.27.0medium6.28.0linux/amd64, linux/arm64
GHSA-q2hr-2g5m-vwhrbrace-expansion5.0.8medium5.0.12linux/amd64, linux/arm64
GHSA-rj75-hqrm-r3gfpostcss-selector-parser7.1.4medium7.1.6linux/amd64, linux/arm64
GHSA-rpw4-54j3-4h4qip-address10.2.0medium10.5.1linux/amd64, linux/arm64
GHSA-v3r7-h72x-cjcmundici6.27.0medium6.28.0linux/amd64, linux/arm64
GHSA-r53p-7pc4-xj5rundici6.27.0low6.28.1linux/amd64, linux/arm64

Tests and rebuilds

Tests
The image's verified recipe declares a smoke test, which clearcutt-factory runs on every platform before it pushes, and it pushes nothing that fails. Nothing attests that the test ran, so it is a claim, not proof. The verified recipe declares a smoke test (/bin/sh -c test "$(id -u)" = 65532 && node --version && npm --version) that clearcutt-factory runs on every platform before it pushes; the result isn't separately attested.
Rebuild
Rebuilt, and the rebuild has the same digest. rebuilt from the signed recipe, 2026-10-17 14:01 UTC
Rebuild gave sha256:b5aae0baa10365078fd9e7ef073333689935d6fc1935b254a87439bc5ba7ea20, the same digest as the image.
Reproduced from the recipe verified on this image by clearcutt-factory v0.3.0 on https://github.com/northcutted/clearcutt-showcase-platform/actions/runs/39038131198/attempts/1, as its verified reproduction attestation says; this run didn't rebuild it.
Checked by a clearcutt-factory reproduction attestation, verified against a trusted signer; this run didn't rebuild it.
Attestation signed by https://github.com/northcutted/clearcutt-factory/.github/workflows/images.yml@refs/tags/v0.3.0 (issuer https://token.actions.githubusercontent.com)
ghcr.io/northcutted/clearcutt-showcase/platform/build-node@sha256:fb356fbf551ff28e0236f2b3123b105da05e30cd38282fc0603feee9ee8e522d
Where it was reproduced, as the attestation says:

Rebase history

Doesn't apply to this image. No rebase record: the image was built, not rebased.

This image over time

This image in each run that recorded per-image rows, newest first, and how it changed since the run before: rebuilt or rebased (a new digest), or its base moved (the same image, its base more or less current). Compare two runs for every image at once.

This image in each run, newest first
RunDigestVerdictBaseCriticalHigh
2026-10-19 07:41 UTCsha256:b5aae0baa103 Verified Proven, stale
sha256:030e45cb3718 (linux/amd64)
06
2026-10-19 01:05 UTCsha256:b5aae0baa103 Verified Proven, stale
sha256:030e45cb3718 (linux/amd64)
06
2026-10-19 01:02 UTCsha256:b5aae0baa103 Verified Proven, stale
sha256:030e45cb3718 (linux/amd64)
06
2026-10-19 00:27 UTCsha256:b5aae0baa103 Verified Proven, stale
sha256:030e45cb3718 (linux/amd64)
06
2026-10-19 00:20 UTCsha256:b5aae0baa103 Verified Proven, stale
sha256:030e45cb3718 (linux/amd64)
06
2026-10-18 14:29 UTCsha256:b5aae0baa103 Verified Proven, stale
sha256:030e45cb3718 (linux/amd64)
06
2026-10-18 14:11 UTCsha256:b5aae0baa103 Verified Proven, stale
sha256:030e45cb3718 (linux/amd64)
06
2026-10-18 14:10 UTCsha256:b5aae0baa103 Verified Proven, stale
sha256:030e45cb3718 (linux/amd64)
06
2026-10-18 07:25 UTCsha256:b5aae0baa103
base moved
 Verified Proven, stale
sha256:030e45cb3718 (linux/amd64)
06
2026-10-17 14:43 UTCsha256:b5aae0baa103 Verified Proven, current
sha256:030e45cb3718 (linux/amd64)
06
2026-10-17 14:38 UTCsha256:b5aae0baa103 Verified Proven, current
sha256:030e45cb3718 (linux/amd64)
06
2026-10-17 14:06 UTCsha256:b5aae0baa103 Verified Proven, current
sha256:030e45cb3718 (linux/amd64)
06
2026-10-17 14:03 UTCsha256:b5aae0baa103
rebuilt, same base
 Verified Proven, current
sha256:030e45cb3718 (linux/amd64)
06
2026-10-17 12:20 UTCsha256:d12eb9332371 Verified Proven, current
sha256:030e45cb3718 (linux/amd64)
06
2026-10-17 07:25 UTCsha256:d12eb9332371 Verified Proven, current
sha256:030e45cb3718 (linux/amd64)
06
2026-10-17 03:58 UTCsha256:d12eb9332371 Verified Proven, current
sha256:030e45cb3718 (linux/amd64)
06
2026-10-17 01:19 UTCsha256:d12eb9332371 Verified Proven, current
sha256:030e45cb3718 (linux/amd64)
06

? means unknown: the run had no vulnerability data for this image.

Critical findings
102026-10-172026-10-192026-10-17 01:19 UTC: 02026-10-17 03:58 UTC: 02026-10-17 07:25 UTC: 02026-10-17 12:20 UTC: 02026-10-17 14:03 UTC: 02026-10-17 14:06 UTC: 02026-10-17 14:38 UTC: 02026-10-17 14:43 UTC: 02026-10-18 07:25 UTC: 02026-10-18 14:10 UTC: 02026-10-18 14:11 UTC: 02026-10-18 14:29 UTC: 02026-10-19 00:20 UTC: 02026-10-19 00:27 UTC: 02026-10-19 01:02 UTC: 02026-10-19 01:05 UTC: 02026-10-19 07:41 UTC: 00
High findings
1002026-10-172026-10-192026-10-17 01:19 UTC: 62026-10-17 03:58 UTC: 62026-10-17 07:25 UTC: 62026-10-17 12:20 UTC: 62026-10-17 14:03 UTC: 62026-10-17 14:06 UTC: 62026-10-17 14:38 UTC: 62026-10-17 14:43 UTC: 62026-10-18 07:25 UTC: 62026-10-18 14:10 UTC: 62026-10-18 14:11 UTC: 62026-10-18 14:29 UTC: 62026-10-19 00:20 UTC: 62026-10-19 00:27 UTC: 62026-10-19 01:02 UTC: 62026-10-19 01:05 UTC: 62026-10-19 07:41 UTC: 66

Platforms

PlatformDigestLayersCompressed size
linux/amd64sha256:b6e82726ad9e94c0c4d8eae208a09295c631b405c18e7717c47afd814c92b6bb1259 MB
linux/arm64sha256:92debff5e5c221ec2d7e1033b8236ad358b41855c6ae9caf3f4ce41d22a874b71256 MB

Packages

Read from its SBOM, which is Found, and checked against a trusted signer in the policy.; the union of the linux/amd64, linux/arm64 images' lists.

176 package versions
PackageVersionType
@gar/promise-retry1.0.3npm
@isaacs/fs-minipass4.0.1npm
@isaacs/string-locale-compare1.1.0npm
@npmcli/agent5.0.2npm
@npmcli/arborist10.0.2npm
@npmcli/config11.0.1npm
@npmcli/fs6.0.0npm
@npmcli/git8.0.0npm
@npmcli/installed-package-contents5.0.0npm
@npmcli/map-workspaces6.0.0npm
@npmcli/metavuln-calculator10.0.0npm
@npmcli/name-from-folder5.0.0npm
@npmcli/node-gyp6.0.0npm
@npmcli/package-json8.0.0npm
@npmcli/promise-spawn10.0.0npm
@npmcli/query5.0.0npm
@npmcli/redact5.0.0npm
@npmcli/run-script11.0.0npm
@sigstore/bundle5.0.0npm
@sigstore/core4.0.1npm
@sigstore/protobuf-specs0.5.1npm
@sigstore/sign5.0.0npm
@sigstore/tuf5.0.0npm
@sigstore/verify4.1.0npm
@tufjs/canonical-json2.0.0npm
@tufjs/models5.0.0npm
abbrev5.0.0npm
agent-base9.0.0npm
apk-tools2.14.10-r17apk
aproba2.1.0npm
archy1.0.0npm
balanced-match4.0.4npm
bin-links7.0.0npm
binary-extensions3.1.0npm
brace-expansion5.0.8npm
busybox1.38.0-r3apk
c-ares1.34.8-r4apk
ca-certificates-bundle20260909-r2apk
cacache21.0.1npm
chalk5.6.2npm
chownr3.0.0npm
ci-info4.4.0npm
cidr-regex6.0.0npm
cmd-shim9.0.2npm
common-ancestor-path2.0.0npm
cssesc3.0.0npm
debug4.4.3npm
diff8.0.4npm
env-paths2.2.1npm
exponential-backoff3.1.3npm
fastest-levenshtein1.0.16npm
fdir6.5.0npm
fs-minipass3.0.3npm
glibc-2.442.44-r8apk
glibc-2.44-locale-posix2.44-r8apk
glob13.0.6npm
graceful-fs4.2.11npm
hosted-git-info10.1.1npm
http-cache-semantics4.2.0npm
http-proxy-agent9.1.0npm
https-proxy-agent9.1.0npm
iconv-lite0.7.3npm
icu78-data-full78.3-r4apk
ignore-walk9.0.0npm
ini7.0.0npm
init-package-json9.0.0npm
ip-address10.2.0npm
is-cidr7.0.0npm
isexe4.0.0npm
json-parse-even-better-errors6.0.0npm
json-stringify-nice1.1.4npm
jsonparse1.3.1npm
just-diff6.0.2npm
just-diff-apply5.5.0npm
ld-linux-2.442.44-r8apk
libbrotlicommon11.2.0-r6apk
libbrotlidec11.2.0-r6apk
libbrotlienc11.2.0-r6apk
libcrypt1-2.442.44-r8apk
libgcc16.2.0-r1apk
libicu7878.3-r4apk
libnghttp2-141.70.0-r5apk
libnpmaccess11.0.0npm
libnpmdiff9.0.2npm
libnpmexec11.0.2npm
libnpmfund8.0.2npm
libnpmorg9.0.0npm
libnpmpack10.0.2npm
libnpmpublish12.0.0npm
libnpmsearch10.0.0npm
libnpmteam9.0.0npm
libnpmversion9.0.0npm
libstdc++16.2.0-r1apk
libuv1.53.0-r0apk
libxcrypt4.5.2-r6apk
lru-cache11.5.2npm
make-fetch-happen16.0.1npm
minimatch10.2.3npm
minipass3.3.6npm
minipass7.1.3npm
minipass-collect2.0.1npm
minipass-fetch6.0.0npm
minipass-flush1.0.6npm
minipass-pipeline1.2.4npm
minipass-sized2.0.0npm
minizlib3.1.0npm
ms2.1.3npm
mute-stream4.0.0npm
negotiator1.0.0npm
node-gyp13.1.0npm
node-gyp13.1.0-r0apk
nodejs-2424.22.0-r0apk
nopt10.0.1npm
npm12.0.2npm
npm12.0.2-r0apk
npm-audit-report8.0.0npm
npm-bundled6.0.0npm
npm-install-checks9.0.0npm
npm-normalize-package-bin6.0.0npm
npm-package-arg14.0.0npm
npm-packlist11.3.0npm
npm-pick-manifest12.0.0npm
npm-profile13.0.1npm
npm-registry-fetch20.0.1npm
npm-user-validate5.0.0npm
openssl-4.0-libcrypto4.0.3-r7apk
openssl-4.0-libssl4.0.3-r7apk
openssl-provider-legacy-allowed4.0.3-r1apk
p-map7.0.5npm
pacote22.0.0npm
parse-conflict-json6.0.0npm
path-scurry2.0.2npm
picomatch4.0.4npm
picomatch4.0.7npm
postcss-selector-parser7.1.4npm
proc-log7.0.0npm
proggy4.0.0npm
promise-all-reject-late1.0.1npm
promise-call-limit3.0.2npm
promzard4.0.0npm
proxy-agent-negotiate1.1.0npm
qrcode-terminal0.12.0npm
read6.0.0npm
read-cmd-shim7.0.0npm
safer-buffer2.1.2npm
semver7.8.5npm
signal-exit4.1.0npm
sigstore5.0.0npm
smart-buffer4.2.0npm
socks2.8.9npm
socks-proxy-agent10.1.0npm
spdx-exceptions2.5.0npm
spdx-expression-parse4.0.0npm
spdx-license-ids3.0.23npm
ssri14.0.0npm
supports-color10.2.2npm
tar7.5.21npm
tar7.5.22npm
text-table0.2.0npm
tiny-relative-date2.0.2npm
tinyglobby0.2.17npm
treeverse3.0.0npm
tuf-js6.0.0npm
undici6.27.0npm
undici8.11.2npm
util-deprecate1.0.2npm
validate-npm-package-name8.0.0npm
walk-up-path4.0.0npm
which7.0.0npm
wolfi-base1-r7apk
wolfi-baselayout20230201-r30apk
wolfi-keys1-r13apk
write-file-atomic8.0.0npm
yallist4.0.0npm
yallist5.0.0npm
zlib1.3.2.1_rc20260921-r0apk