@algolia/client-account
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| provenance | publisher-changed | AI (provenance): Publisher change reflects a legitimate Algolia org maintainer rotation; haroenv has a strong track record and the package remains under the @algolia scope. | ai | |
| maintainer-change | maintainer-added | AI (maintainer-change): New maintainers are consistent with internal Algolia team restructuring; package remains under the official @algolia scoped namespace. | ai | |
| maintainer-change | maintainer-removed | AI (maintainer-change): Removed maintainers are consistent with Algolia team rotation, not a hostile takeover; no other malicious indicators present. | ai | |
| dependencies | unvetted-dep:@algolia/transporter | AI (dependencies): @algolia/transporter is a first-party Algolia monorepo package always pinned to the same version as this package; stable false positive for this package. | ai | |
| npm-metadata | no-description | AI (npm-metadata): Scoped monorepo sub-package from Algolia; missing description is a consistent pattern across all versions and not a malicious indicator. | ai |
Versions (showing 51 of 63)
| Version | Deps | Published |
|---|---|---|
| 4.27.0 | 3 / 0 | |
| 4.26.0 | 3 / 0 | |
| 4.25.3 | 3 / 0 | |
| 4.25.2 | 3 / 0 | |
| 4.25.1 | 3 / 0 | |
| 4.25.0 | 3 / 0 | |
| 4.24.0 | 3 / 0 | |
| 4.23.3 | 3 / 0 | |
| 4.23.2 | 3 / 0 | |
| 4.23.1 | 3 / 0 | |
| 4.23.0 | 3 / 0 | |
| 4.22.1 | 3 / 0 | |
| 4.22.0 | 3 / 0 | |
| 4.21.1 | 3 / 0 | |
| 4.21.0 | 3 / 0 | |
| 4.20.0 | 3 / 0 | |
| 4.19.1 | 3 / 0 | |
| 4.19.0 | 3 / 0 | |
| 4.18.0 | 3 / 0 | |
| 4.17.2 | 3 / 0 | |
| 4.17.1 | 3 / 0 | |
| 4.17.0 | 3 / 0 | |
| 4.16.0 | 3 / 0 | |
| 4.15.0 | 3 / 0 | |
| 4.14.3 | 3 / 0 | |
| 4.14.2 | 3 / 0 | |
| 4.14.1 | 3 / 0 | |
| 4.14.0 | 3 / 0 | |
| 4.13.1 | 3 / 0 | |
| 4.13.0 | 3 / 0 | |
| 4.12.2 | 3 / 0 | |
| 4.12.1 | 3 / 0 | |
| 4.12.0 | 3 / 0 | |
| 4.11.0 | 3 / 0 | |
| 4.10.5 | 3 / 0 | |
| 4.10.4 | 3 / 0 | |
| 4.10.3 | 3 / 0 | |
| 4.10.2 | 3 / 0 | |
| 4.10.0 | 3 / 0 | |
| 4.9.3 | 3 / 0 | |
| 4.9.2 | 3 / 0 | |
| 4.9.1 | 3 / 0 | |
| 4.9.0 | 3 / 0 | |
| 4.8.6 | 3 / 0 | |
| 4.8.5 | 3 / 0 | |
| 4.8.4 | 3 / 0 | |
| 4.8.3 | 3 / 0 | |
| 4.8.2 | 3 / 0 | |
| 4.8.1 | 3 / 0 | |
| 4.8.0 | 3 / 0 | |
| 4.7.0 | 3 / 0 |
v4.27.0
2 findingsThis version was published by a different npm account than previous versions on 2026-02-27. This could indicate a legitimate maintainer transition or an account compromise.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.26.0
2 findingsThis version was published by a different npm account than previous versions on 2026-02-17. This could indicate a legitimate maintainer transition or an account compromise.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.25.3
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.25.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.25.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.25.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.24.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.23.3
2 findingsThis version was published by a different npm account than previous versions on 2024-04-10. This could indicate a legitimate maintainer transition or an account compromise.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.23.2
2 findingsThis version was published by a different npm account than previous versions on 2024-03-27. This could indicate a legitimate maintainer transition or an account compromise.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.23.1
2 findingsThis version was published by a different npm account than previous versions on 2024-03-26. This could indicate a legitimate maintainer transition or an account compromise.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.23.0
2 findingsThis version was published by a different npm account than previous versions on 2024-03-26. This could indicate a legitimate maintainer transition or an account compromise.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.22.1
2 findingsThis version was published by a different npm account than previous versions on 2024-01-09. This could indicate a legitimate maintainer transition or an account compromise.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.22.0
2 findingsThis version was published by a different npm account than previous versions on 2023-12-14. This could indicate a legitimate maintainer transition or an account compromise.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.21.1
2 findingsThis version was published by a different npm account than previous versions on 2023-12-12. This could indicate a legitimate maintainer transition or an account compromise.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.21.0
2 findingsThis version was published by a different npm account than previous versions on 2023-12-11. This could indicate a legitimate maintainer transition or an account compromise.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.20.0
2 findingsThis version was published by a different npm account than previous versions on 2023-09-12. This could indicate a legitimate maintainer transition or an account compromise.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.19.1
2 findingsThis version was published by a different npm account than previous versions on 2023-07-20. This could indicate a legitimate maintainer transition or an account compromise.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.19.0
2 findingsThis version was published by a different npm account than previous versions on 2023-07-18. This could indicate a legitimate maintainer transition or an account compromise.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.18.0
2 findingsThis version was published by a different npm account than previous versions on 2023-06-23. This could indicate a legitimate maintainer transition or an account compromise.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.17.2
2 findingsThis version was published by a different npm account than previous versions on 2023-06-08. This could indicate a legitimate maintainer transition or an account compromise.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.17.1
2 findingsThis version was published by a different npm account than previous versions on 2023-05-24. This could indicate a legitimate maintainer transition or an account compromise.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.17.0
2 findingsThis version was published by a different npm account than previous versions on 2023-04-03. This could indicate a legitimate maintainer transition or an account compromise.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.16.0
2 findingsThis version was published by a different npm account than previous versions on 2023-03-23. This could indicate a legitimate maintainer transition or an account compromise.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.15.0
2 findingsThis version was published by a different npm account than previous versions on 2023-03-02. This could indicate a legitimate maintainer transition or an account compromise.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.14.3
2 findingsThis version was published by a different npm account than previous versions on 2022-12-19. This could indicate a legitimate maintainer transition or an account compromise.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.14.2
2 findingsThis version was published by a different npm account than previous versions on 2022-07-27. This could indicate a legitimate maintainer transition or an account compromise.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.14.1
2 findingsThis version was published by a different npm account than previous versions on 2022-07-20. This could indicate a legitimate maintainer transition or an account compromise.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.14.0
2 findingsThis version was published by a different npm account than previous versions on 2022-07-18. This could indicate a legitimate maintainer transition or an account compromise.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.13.1
2 findingsThis version was published by a different npm account than previous versions on 2022-05-18. This could indicate a legitimate maintainer transition or an account compromise.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.13.0
2 findingsThis version was published by a different npm account than previous versions on 2022-03-14. This could indicate a legitimate maintainer transition or an account compromise.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.12.2
2 findingsThis version was published by a different npm account than previous versions on 2022-03-02. This could indicate a legitimate maintainer transition or an account compromise.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.12.1
2 findingsThis version was published by a different npm account than previous versions on 2022-01-28. This could indicate a legitimate maintainer transition or an account compromise.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.12.0
2 findingsThis version was published by a different npm account than previous versions on 2022-01-07. This could indicate a legitimate maintainer transition or an account compromise.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.11.0
2 findingsThis version was published by a different npm account than previous versions on 2021-10-20. This could indicate a legitimate maintainer transition or an account compromise.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.10.5
2 findingsThis version was published by a different npm account than previous versions on 2021-08-26. This could indicate a legitimate maintainer transition or an account compromise.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.10.4
2 findingsThis version was published by a different npm account than previous versions on 2021-08-23. This could indicate a legitimate maintainer transition or an account compromise.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.10.3
2 findingsThis version was published by a different npm account than previous versions on 2021-07-05. This could indicate a legitimate maintainer transition or an account compromise.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.10.2
2 findingsThis version was published by a different npm account than previous versions on 2021-06-23. This could indicate a legitimate maintainer transition or an account compromise.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.10.0
2 findingsThis version was published by a different npm account than previous versions on 2021-06-23. This could indicate a legitimate maintainer transition or an account compromise.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.9.3
2 findingsThis version was published by a different npm account than previous versions on 2021-06-15. This could indicate a legitimate maintainer transition or an account compromise.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.9.2
2 findingsThis version was published by a different npm account than previous versions on 2021-06-10. This could indicate a legitimate maintainer transition or an account compromise.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.9.1
2 findingsThis version was published by a different npm account than previous versions on 2021-04-26. This could indicate a legitimate maintainer transition or an account compromise.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.9.0
2 findingsThis version was published by a different npm account than previous versions on 2021-04-13. This could indicate a legitimate maintainer transition or an account compromise.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.8.6
2 findingsThis version was published by a different npm account than previous versions on 2021-03-08. This could indicate a legitimate maintainer transition or an account compromise.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.8.5
2 findingsThis version was published by a different npm account than previous versions on 2021-02-08. This could indicate a legitimate maintainer transition or an account compromise.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.8.4
2 findingsThis version was published by a different npm account than previous versions on 2021-01-20. This could indicate a legitimate maintainer transition or an account compromise.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.8.3
2 findingsThis version was published by a different npm account than previous versions on 2020-12-03. This could indicate a legitimate maintainer transition or an account compromise.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.8.2
2 findingsThis version was published by a different npm account than previous versions on 2020-11-26. This could indicate a legitimate maintainer transition or an account compromise.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.8.1
2 findingsThis version was published by a different npm account than previous versions on 2020-11-25. This could indicate a legitimate maintainer transition or an account compromise.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.8.0
2 findingsThis version was published by a different npm account than previous versions on 2020-11-19. This could indicate a legitimate maintainer transition or an account compromise.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.7.0
2 findingsThis version was published by a different npm account than previous versions on 2020-11-16. This could indicate a legitimate maintainer transition or an account compromise.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.