Google Cloud Storage (JS)
npm@google-cloud/storageThe Google Cloud Storage Node.js client provides access to GCS buckets for server-side Node.js applications and Google Cloud Functions. It authenticates via Application Default Credentials, service account keys, or Workload Identity. It is used in Node.js data processing pipelines and file storage backends.
Checking Google Cloud Storage (JS)
@google-cloud/storage 7.12.0 is a clean, monitored version with no known supply chain compromise. The example response returns supply_chain_monitored: true and compromised: false with an empty sources array.
curl "https://api.attestd.io/v1/check?product=%40google-cloud%2Fstorage&version=7.12.0" \
-H "Authorization: Bearer YOUR_API_KEY"{
"product": "@google-cloud/storage",
"version": "7.12.0",
"supported": true,
"risk_state": "none",
"risk_factors": [],
"actively_exploited": false,
"remote_exploitable": false,
"authentication_required": false,
"patch_available": false,
"fixed_version": null,
"confidence": 0.9,
"cve_ids": [],
"cves": null,
"max_epss": null,
"typosquat": null,
"supply_chain_monitored": true,
"supply_chain": {
"compromised": false,
"sources": [],
"malware_type": null,
"description": null,
"advisory_url": null,
"compromised_at": null,
"removed_at": null
},
"last_updated": "2026-05-01T00:00:00Z"
}Why this package is monitored
The GCS Node client authenticates via ADC, service account keys, or Workload Identity at startup. A hostile package can export that resolved credential before any bucket operation.
Attestd monitors @google-cloud/storage using the following detection sources:
registryManually curated advisories in the Attestd registry, verified by a human analyst. Confidence 1.0.
osvOSV.dev malicious-package advisories with IDs prefixed MAL-. Confidence 0.95.
npm_deprecationnpm package versions with deprecation messages containing targeted attack language such as malicious, backdoor, or compromised. Confidence 0.80.