@algolia/cache-in-memory
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| provenance | publisher-changed | AI (provenance): haroenv is a known Algolia contributor with a strong track record; publisher changes reflect normal team transitions at Algolia across their JS client monorepo. | ai | |
| maintainer-change | maintainer-added | AI (maintainer-change): New maintainers are Algolia team members; additions reflect normal organizational growth for this official Algolia SDK package. | ai | |
| maintainer-change | maintainer-removed | AI (maintainer-change): Removed maintainers reflect normal team turnover at Algolia; no malicious indicators present alongside this change. | ai | |
| provenance | no-provenance | AI (provenance): Established Algolia monorepo package with 81 versions; lack of provenance attestation is a historical pattern for this package, not a new risk. | ai |
Versions (showing 51 of 63)
| Version | Deps | Published |
|---|---|---|
| 4.27.0 | 1 / 0 | |
| 4.26.0 | 1 / 0 | |
| 4.25.3 | 1 / 0 | |
| 4.25.2 | 1 / 0 | |
| 4.25.1 | 1 / 0 | |
| 4.25.0 | 1 / 0 | |
| 4.24.0 | 1 / 0 | |
| 4.23.3 | 1 / 0 | |
| 4.23.2 | 1 / 0 | |
| 4.23.1 | 1 / 0 | |
| 4.23.0 | 1 / 0 | |
| 4.22.1 | 1 / 0 | |
| 4.22.0 | 1 / 0 | |
| 4.21.1 | 1 / 0 | |
| 4.21.0 | 1 / 0 | |
| 4.20.0 | 1 / 0 | |
| 4.19.1 | 1 / 0 | |
| 4.19.0 | 1 / 0 | |
| 4.18.0 | 1 / 0 | |
| 4.17.2 | 1 / 0 | |
| 4.17.1 | 1 / 0 | |
| 4.17.0 | 1 / 0 | |
| 4.16.0 | 1 / 0 | |
| 4.15.0 | 1 / 0 | |
| 4.14.3 | 1 / 0 | |
| 4.14.2 | 1 / 0 | |
| 4.14.1 | 1 / 0 | |
| 4.14.0 | 1 / 0 | |
| 4.13.1 | 1 / 0 | |
| 4.13.0 | 1 / 0 | |
| 4.12.2 | 1 / 0 | |
| 4.12.1 | 1 / 0 | |
| 4.12.0 | 1 / 0 | |
| 4.11.0 | 1 / 0 | |
| 4.10.5 | 1 / 0 | |
| 4.10.4 | 1 / 0 | |
| 4.10.3 | 1 / 0 | |
| 4.10.2 | 1 / 0 | |
| 4.10.0 | 1 / 0 | |
| 4.9.3 | 1 / 0 | |
| 4.9.2 | 1 / 0 | |
| 4.9.1 | 1 / 0 | |
| 4.9.0 | 1 / 0 | |
| 4.8.6 | 1 / 0 | |
| 4.8.5 | 1 / 0 | |
| 4.8.4 | 1 / 0 | |
| 4.8.3 | 1 / 0 | |
| 4.8.2 | 1 / 0 | |
| 4.8.1 | 1 / 0 | |
| 4.8.0 | 1 / 0 | |
| 4.7.0 | 1 / 0 |
v4.27.0
2 findingsThis version was published by a different npm account than previous versions on 2026-02-27. This could indicate a legitimate maintainer transition or an account compromise.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.26.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.25.3
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.25.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.25.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.25.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.24.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.23.3
2 findingsThis version was published by a different npm account than previous versions on 2024-04-10. This could indicate a legitimate maintainer transition or an account compromise.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.23.2
2 findingsThis version was published by a different npm account than previous versions on 2024-03-27. This could indicate a legitimate maintainer transition or an account compromise.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.23.1
2 findingsThis version was published by a different npm account than previous versions on 2024-03-26. This could indicate a legitimate maintainer transition or an account compromise.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.23.0
2 findingsThis version was published by a different npm account than previous versions on 2024-03-26. This could indicate a legitimate maintainer transition or an account compromise.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.22.1
2 findingsThis version was published by a different npm account than previous versions on 2024-01-09. This could indicate a legitimate maintainer transition or an account compromise.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.22.0
2 findingsThis version was published by a different npm account than previous versions on 2023-12-14. This could indicate a legitimate maintainer transition or an account compromise.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.21.1
2 findingsThis version was published by a different npm account than previous versions on 2023-12-12. This could indicate a legitimate maintainer transition or an account compromise.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.21.0
2 findingsThis version was published by a different npm account than previous versions on 2023-12-11. This could indicate a legitimate maintainer transition or an account compromise.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.20.0
2 findingsThis version was published by a different npm account than previous versions on 2023-09-12. This could indicate a legitimate maintainer transition or an account compromise.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.19.1
2 findingsThis version was published by a different npm account than previous versions on 2023-07-20. This could indicate a legitimate maintainer transition or an account compromise.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.19.0
2 findingsThis version was published by a different npm account than previous versions on 2023-07-18. This could indicate a legitimate maintainer transition or an account compromise.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.18.0
2 findingsThis version was published by a different npm account than previous versions on 2023-06-23. This could indicate a legitimate maintainer transition or an account compromise.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.17.2
2 findingsThis version was published by a different npm account than previous versions on 2023-06-08. This could indicate a legitimate maintainer transition or an account compromise.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.17.1
2 findingsThis version was published by a different npm account than previous versions on 2023-05-24. This could indicate a legitimate maintainer transition or an account compromise.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.17.0
2 findingsThis version was published by a different npm account than previous versions on 2023-04-03. This could indicate a legitimate maintainer transition or an account compromise.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.16.0
2 findingsThis version was published by a different npm account than previous versions on 2023-03-23. This could indicate a legitimate maintainer transition or an account compromise.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.15.0
2 findingsThis version was published by a different npm account than previous versions on 2023-03-02. This could indicate a legitimate maintainer transition or an account compromise.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.14.3
2 findingsThis version was published by a different npm account than previous versions on 2022-12-19. This could indicate a legitimate maintainer transition or an account compromise.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.14.2
2 findingsThis version was published by a different npm account than previous versions on 2022-07-27. This could indicate a legitimate maintainer transition or an account compromise.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.14.1
2 findingsThis version was published by a different npm account than previous versions on 2022-07-20. This could indicate a legitimate maintainer transition or an account compromise.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.14.0
2 findingsThis version was published by a different npm account than previous versions on 2022-07-18. This could indicate a legitimate maintainer transition or an account compromise.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.13.1
2 findingsThis version was published by a different npm account than previous versions on 2022-05-18. This could indicate a legitimate maintainer transition or an account compromise.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.13.0
2 findingsThis version was published by a different npm account than previous versions on 2022-03-14. This could indicate a legitimate maintainer transition or an account compromise.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.12.2
2 findingsThis version was published by a different npm account than previous versions on 2022-03-02. This could indicate a legitimate maintainer transition or an account compromise.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.12.1
2 findingsThis version was published by a different npm account than previous versions on 2022-01-28. This could indicate a legitimate maintainer transition or an account compromise.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.12.0
2 findingsThis version was published by a different npm account than previous versions on 2022-01-07. This could indicate a legitimate maintainer transition or an account compromise.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.11.0
2 findingsThis version was published by a different npm account than previous versions on 2021-10-20. This could indicate a legitimate maintainer transition or an account compromise.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.10.5
2 findingsThis version was published by a different npm account than previous versions on 2021-08-26. This could indicate a legitimate maintainer transition or an account compromise.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.10.4
2 findingsThis version was published by a different npm account than previous versions on 2021-08-23. This could indicate a legitimate maintainer transition or an account compromise.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.10.3
2 findingsThis version was published by a different npm account than previous versions on 2021-07-05. This could indicate a legitimate maintainer transition or an account compromise.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.10.2
2 findingsThis version was published by a different npm account than previous versions on 2021-06-23. This could indicate a legitimate maintainer transition or an account compromise.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.10.0
2 findingsThis version was published by a different npm account than previous versions on 2021-06-23. This could indicate a legitimate maintainer transition or an account compromise.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.9.3
2 findingsThis version was published by a different npm account than previous versions on 2021-06-15. This could indicate a legitimate maintainer transition or an account compromise.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.9.2
2 findingsThis version was published by a different npm account than previous versions on 2021-06-10. This could indicate a legitimate maintainer transition or an account compromise.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.9.1
2 findingsThis version was published by a different npm account than previous versions on 2021-04-26. This could indicate a legitimate maintainer transition or an account compromise.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.9.0
2 findingsThis version was published by a different npm account than previous versions on 2021-04-13. This could indicate a legitimate maintainer transition or an account compromise.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.8.6
2 findingsThis version was published by a different npm account than previous versions on 2021-03-08. This could indicate a legitimate maintainer transition or an account compromise.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.8.5
2 findingsThis version was published by a different npm account than previous versions on 2021-02-08. This could indicate a legitimate maintainer transition or an account compromise.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.8.4
2 findingsThis version was published by a different npm account than previous versions on 2021-01-20. This could indicate a legitimate maintainer transition or an account compromise.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.8.3
2 findingsThis version was published by a different npm account than previous versions on 2020-12-03. This could indicate a legitimate maintainer transition or an account compromise.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.8.2
2 findingsThis version was published by a different npm account than previous versions on 2020-11-26. This could indicate a legitimate maintainer transition or an account compromise.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.8.1
2 findingsThis version was published by a different npm account than previous versions on 2020-11-25. This could indicate a legitimate maintainer transition or an account compromise.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.8.0
2 findingsThis version was published by a different npm account than previous versions on 2020-11-19. This could indicate a legitimate maintainer transition or an account compromise.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.7.0
2 findingsThis version was published by a different npm account than previous versions on 2020-11-16. This could indicate a legitimate maintainer transition or an account compromise.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.