Home / npm

Is capnweb safe to install?

ALLOW Nothing DepWall checks for fired on version 0.12.0.

Checked 2026-09-20 against version 0.12.0, using the same engine the CLI runs. This is a record of one check at one moment — run the gate for the answer that applies to the version you are about to install.

What the registry says

Signals

None of DepWall's blocking or asking signals fired on version 0.12.0 when it was checked on 2026-09-20.

Informational notes recorded on this version:

• attestation — "[email protected]" is published with an npm provenance attestation (SLSA) — verifies build origin, not behavior

That is not a safety certificate. It means the checks listed below were quiet on one version at one moment. It says nothing about later versions, about this package's dependencies, or about the attack classes DepWall does not claim to detect — maintainer compromise above all, which is precisely the class that leaves every structural signal green.

What was checked

DepWall reads registry metadata and the package's own manifest before any of its code runs. On npm that means the name against a popularity dictionary and a curated hallucination feed, the tarball hash against OSV's malicious-release advisories, lifecycle scripts, publication age and adoption, provenance attestations across this and prior releases, and dependencies that resolve outside the registry.

It does not execute the package, and this page did not download its source. How verdicts are decided · what this cannot catch.

Check it yourself

npm i -g depwall && depwall init
depwall check capnweb

Once depwall init has run, the check happens on npm install itself — including for the transitive dependencies you never chose, which is where most of this actually arrives.