Hono
npmhonoHono is a lightweight, ultra-fast web framework for edge runtimes (Cloudflare Workers, Deno Deploy, Bun) as well as Node.js. It is used in serverless API handlers, reverse proxies, and edge middleware. Its small footprint and multi-runtime support have made it popular for AI API proxying.
Checking Hono
hono 4.6.0 is a clean, monitored version with no known supply chain compromise. The example response returns supply_chain_monitored: true and compromised: false with an empty sources array.
curl "https://api.attestd.io/v1/check?product=hono&version=4.6.0" \
-H "Authorization: Bearer YOUR_API_KEY"{
"product": "hono",
"version": "4.6.0",
"supported": true,
"risk_state": "none",
"risk_factors": [],
"actively_exploited": false,
"remote_exploitable": false,
"authentication_required": false,
"patch_available": false,
"fixed_version": null,
"confidence": 0.9,
"cve_ids": [],
"cves": null,
"max_epss": null,
"typosquat": null,
"supply_chain_monitored": true,
"supply_chain": {
"compromised": false,
"sources": [],
"malware_type": null,
"description": null,
"advisory_url": null,
"compromised_at": null,
"removed_at": null
},
"last_updated": "2026-05-01T00:00:00Z"
}Why this package is monitored
Hono often fronts Cloudflare Workers, Deno Deploy, and Bun handlers used as API proxies. A poisoned edge build can siphon request traffic in runtimes that leave little server-side logging.
Attestd monitors hono using the following detection sources:
registryManually curated advisories in the Attestd registry, verified by a human analyst. Confidence 1.0.
osvOSV.dev malicious-package advisories with IDs prefixed MAL-. Confidence 0.95.
npm_deprecationnpm package versions with deprecation messages containing targeted attack language such as malicious, backdoor, or compromised. Confidence 0.80.