@ampproject/toolbox-optimizer

Server-side rendering for AMPs.

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.

Maintainers

ampproject-adminkristoferbaxterjridgewellchoumxamp-toolboxfstaniserwinmombaysamouricaroqliursimhadvoytenkopatrickkettneralanorozcokdwanampprojectbotesth

Keywords

amp

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
provenance	no-provenance	AI (provenance): Trusted ampproject publisher with 130 approved packages; lack of Sigstore provenance is not a meaningful risk signal for this package.	ai	2026/04/24
publish-pattern	new-deps-added	AI (publish-pattern): cssnano replaced by cssnano-simple (lighter variant) and https-proxy-agent added for proxy support — both legitimate, well-known packages for an optimizer tool.	ai	2026/04/24
maintainer-change	maintainer-added	AI (maintainer-change): AMP Project is a large OSS initiative; maintainer additions are routine team growth. Publisher account has 123 approved / 0 rejected packages.	ai	2026/04/24
provenance	publisher-changed	AI (provenance): Publisher change from amp-toolbox to ampproject-admin reflects a legitimate org-level account consolidation; ampproject-admin has a clean track record and the repo URL remains the official ampproject GitHub org.	ai	2026/04/24
install-scripts	install-script:postinstall	AI (install-scripts): Postinstall runs 'node lib/warmup.js', a benign warmup step present across many versions of this established AMP Project package. Not a new addition.	ai	2026/04/24
phantom-deps	phantom-dep:abort-controller	AI (phantom-deps): abort-controller is explicitly declared in package.json dependencies; used indirectly/via config rather than direct import. Legitimate declared dependency.	ai	2026/04/23
semgrep	semgrep:dynamic-require	AI (semgrep): Dynamic require loads from a fixed local subdirectory (./transformers/) based on config-supplied transformer names. This is a standard plugin-loading pattern in a build tool, not an arbitrary code execution risk.	ai	2026/04/23
phantom-deps	phantom-dep:https-proxy-agent	AI (phantom-deps): https-proxy-agent is explicitly declared in package.json dependencies; used indirectly/via config rather than direct import. Legitimate declared dependency.	ai	2026/04/23

Versions (showing 34 of 34)

Version	Deps	Published
2.10.1	17 / 0	2024-06-14
2.10.0	17 / 0	2024-06-13
2.9.0	17 / 0	2022-06-23
2.8.10	17 / 0	2022-03-16
2.8.9	17 / 0	2022-03-10
2.8.8	17 / 0	2022-02-11
2.8.7	17 / 0	2022-01-14
2.8.6	18 / 0	2022-01-12
2.8.5	17 / 0	2022-01-12
2.8.4	17 / 0	2021-11-17
2.8.3	17 / 0	2021-07-12
2.8.2	17 / 0	2021-07-02
2.8.1	17 / 0	2021-06-10
2.8.0	17 / 0	2021-05-31
2.7.1	18 / 0	2020-12-02
2.6.0	18 / 0	2020-08-10
2.5.12	17 / 0	2020-07-15
2.5.11	17 / 0	2020-07-14
2.5.9	17 / 0	2020-07-08
2.5.8	17 / 0	2020-07-08
2.5.7	17 / 0	2020-07-08
2.5.6	17 / 0	2020-07-07
2.5.0	15 / 0	2020-05-29
2.3.1	11 / 0	2020-05-05
2.3.0	11 / 0	2020-04-15
2.2.0	11 / 0	2020-04-03
2.1.0	10 / 0	2020-04-01
2.0.1	10 / 0	2020-03-18
2.0.0	10 / 0	2020-02-13
1.1.2	6 / 0	2019-10-15
1.1.1	6 / 0	2019-10-08
1.1.0	6 / 0	2019-10-08
1.0.1	5 / 0	2019-08-06
1.0.0	5 / 0	2019-08-06

v2.10.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.10.0

2 findings

HIGH Publisher changed: amp-toolbox → ampproject-admin (on 2024-06-13) provenance

This version was published by a different npm account than previous versions on 2024-06-13. This could indicate a legitimate maintainer transition or an account compromise.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.9.0

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.8.10

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.8.9

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.8.8

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.8.7

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.8.6

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.8.5

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.8.4

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.8.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.8.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.8.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.8.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.7.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.6.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.5.12

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.5.11

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.5.9

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.5.8

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.5.7

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.5.6

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.5.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.3.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.3.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.2.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.1.0

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.0.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.0.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.1.2

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.1.1

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.1.0

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.0.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.0.0

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.