← Home

@algolia/abtesting

npm Repository Homepage
31
Versions
—
License
No
Install Scripts
Verified
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures gitHead linked

Maintainers

ejaldorauharoenvrayrutjesjerskasamousstherealwebbytkruggsylvainhlorrissaintgenezbroujoe-krebskombuchasylvaincrawler-teamamcdaid106devinalgoliajveneziaotomatiksarahdayanmaximehuangguitekmatthewbondshaejazcyril.descossytatsuromathouguixavdhagdavidrasemotteplnechshortcutspraagyajoshialphonsebleodaufabienmottedaltondickalgoliadhaya.bbengreenbankalgabetalg-bgastinneemmanuel.fortindylantientcheuandy_dsrobertmogosjcohonner-algoliacatalgoliaraed-algoliaaymeric.giraudetpjankowski5312eventexperiences_algoliataylorcjohnson_algoliasfaiqhinstantsearch-botflufleviwhalenabodelotmprevell97jkahoantoine.gilleswwalserbhinchley-algolialouishousiauxjsok_algoliaalg-adminhugowitmariamthiam01drodrigulnscyganek-algoliajasonberrybhcastlegavinwade12vascobettencourtmariaaalungucdhawke-algoliafelipe-bernalmorgan-algolia2sirockin_algoliajulia-francaisjcalgoaallam.algtecu23nyagudayevsamykettanijonathaningrammarioalgoliamasterstrikeoctavianiacobminjaslavkoviceric-zahariacmarguta-algoliaharsharora-algoliablaineventurinesarahdayanalgoliagavaudan-algoliamszmaj-algoliayutodalgsamyphilboothcarloscamposfredalgoliawabascript2lotfirafiklachlan.robertson

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
provenance publisher-changed AI (provenance): Algolia migrated publishing to GitHub Actions CI/CD with SLSA attestation; publisher-changed to GitHub Actions is expected and stable for this package going forward. ai
maintainer-change maintainer-added AI (maintainer-change): New maintainer sirockin_algolia has an Algolia-affiliated username; consistent with legitimate internal team management at Algolia. ai
dependencies unvetted-dep:@algolia/client-common AI (dependencies): First-party Algolia monorepo package, co-released with this package. Unvetted status reflects review queue lag, not risk. ai
dependencies unvetted-dep:@algolia/requester-fetch AI (dependencies): First-party Algolia monorepo package, co-released with this package. Unvetted status reflects review queue lag, not risk. ai
dependencies unvetted-dep:@algolia/requester-node-http AI (dependencies): First-party Algolia monorepo package, co-released with this package. Unvetted status reflects review queue lag, not risk. ai
dependencies unvetted-dep:@algolia/requester-browser-xhr AI (dependencies): First-party Algolia monorepo package, co-released with this package. Unvetted status reflects review queue lag, not risk. ai

Versions (showing 31 of 31)

Version Deps Published
1.19.0 4 / 6
1.18.1 4 / 6
1.18.0 4 / 6
1.17.0 4 / 6
1.16.2 4 / 6
1.16.1 4 / 6
1.16.0 4 / 6
1.15.2 4 / 6
1.15.1 4 / 6
1.15.0 4 / 6
1.14.2 4 / 6
1.14.1 4 / 6
1.14.0 4 / 6
1.13.0 4 / 6
1.12.4 4 / 6
1.12.3 4 / 6
1.12.2 4 / 6
1.12.1 4 / 6
1.12.0 4 / 6
1.11.0 4 / 6
1.10.0 4 / 6
1.9.0 4 / 6
1.8.0 4 / 6
1.7.0 4 / 6
1.6.1 4 / 6
1.6.0 4 / 6
1.5.0 4 / 6
1.4.0 4 / 6
1.3.0 4 / 6
1.2.0 4 / 6
1.1.0 4 / 6

v1.19.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.18.1

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.18.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.17.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.16.2

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.16.1

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.16.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.15.2

2 findings
HIGH Publisher changed: shortcuts → GitHub Actions (on 2026-03-09) provenance

This version was published by a different npm account than previous versions on 2026-03-09. This could indicate a legitimate maintainer transition or an account compromise.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.15.1

2 findings
HIGH Publisher changed: shortcuts → GitHub Actions (on 2026-02-24) provenance

This version was published by a different npm account than previous versions on 2026-02-24. This could indicate a legitimate maintainer transition or an account compromise.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.15.0

2 findings
HIGH Publisher changed: shortcuts → GitHub Actions (on 2026-02-18) provenance

This version was published by a different npm account than previous versions on 2026-02-18. This could indicate a legitimate maintainer transition or an account compromise.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.14.2

2 findings
HIGH Publisher changed: shortcuts → GitHub Actions (on 2026-02-17) provenance

This version was published by a different npm account than previous versions on 2026-02-17. This could indicate a legitimate maintainer transition or an account compromise.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.14.1

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.14.0

2 findings
HIGH Publisher changed: shortcuts → GitHub Actions (on 2026-02-05) provenance

This version was published by a different npm account than previous versions on 2026-02-05. This could indicate a legitimate maintainer transition or an account compromise.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.13.0

2 findings
HIGH Publisher changed: shortcuts → GitHub Actions (on 2026-01-20) provenance

This version was published by a different npm account than previous versions on 2026-01-20. This could indicate a legitimate maintainer transition or an account compromise.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.12.4

2 findings
HIGH Publisher changed: shortcuts → GitHub Actions (on 2026-01-20) provenance

This version was published by a different npm account than previous versions on 2026-01-20. This could indicate a legitimate maintainer transition or an account compromise.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.12.3

2 findings
HIGH Publisher changed: shortcuts → GitHub Actions (on 2026-01-13) provenance

This version was published by a different npm account than previous versions on 2026-01-13. This could indicate a legitimate maintainer transition or an account compromise.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.12.2

2 findings
HIGH Publisher changed: shortcuts → GitHub Actions (on 2025-12-23) provenance

This version was published by a different npm account than previous versions on 2025-12-23. This could indicate a legitimate maintainer transition or an account compromise.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.12.1

2 findings
HIGH Publisher changed: shortcuts → GitHub Actions (on 2025-12-17) provenance

This version was published by a different npm account than previous versions on 2025-12-17. This could indicate a legitimate maintainer transition or an account compromise.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.12.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.11.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.10.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.9.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.8.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.7.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.6.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.6.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.5.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.4.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.3.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.2.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.1.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.