@angular/core
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | net-exec-file:schematics/bundles/checker-C9K-IOAk.cjs | AI (source-diff): Angular schematics bundle importing node builtins (ts, fs, path, url, os); standard migration tooling pattern. | ai | |
| source-diff | obfuscated-file:index.d.ts | AI (source-diff): TypeScript declaration file with long re-export lines; not obfuscated. | ai | |
| source-diff | net-exec-file:schematics/bundles/checker-DLkGMJj-.cjs | AI (source-diff): Schematics bundle using TS compiler APIs with fs/path/url imports; standard for Angular migration tooling. | ai | |
| source-diff | large-new-source-files | AI (source-diff): Angular core is a large framework; file count fluctuates across major versions due to chunk restructuring. | ai | |
| phantom-deps | phantom-dep:tslib | AI (phantom-deps): tslib is a standard TypeScript runtime helper used implicitly; well-known pattern. | ai | |
| source-diff | obfuscated-file:fesm2022/_debug_node-chunk.mjs | AI (source-diff): Standard Angular FESM2022 bundle with long import lines; not obfuscation. Normal for framework packages. | ai | |
| source-diff | obfuscated-file:fesm2022/_effect-chunk2.mjs | AI (source-diff): Standard Angular FESM2022 bundle; readable source with license headers and class definitions. | ai | |
| source-diff | obfuscated-file:types/core.d.ts | AI (source-diff): TypeScript declaration file with long re-export lines; standard for large framework type definitions. | ai | |
| provenance | no-provenance | AI (provenance): Older @angular/core versions predate provenance adoption; not a risk signal for this publisher. | ai | |
| bogus-package | bogus-package | AI (bogus-package): @angular/core is a canonical framework package; low-value signals are false positives for scoped Angular packages. | ai | |
| typosquat | typosquat.levenshtein:cors | AI (typosquat): @angular/core is the canonical Angular framework package with 5.3M weekly downloads; not a typosquat of 'cors'. | ai |
Versions (showing 18 of 18)
| Version | Deps | Published |
|---|---|---|
| 21.2.15 | 1 / 0 | |
| 21.2.14 | 1 / 0 | |
| 21.2.13 | 1 / 0 | |
| 21.2.12 | 1 / 0 | |
| 21.2.11 | 1 / 0 | |
| 21.2.10 | 1 / 0 | |
| 21.2.9 | 1 / 0 | |
| 21.2.8 | 1 / 0 | |
| 21.2.7 | 1 / 0 | |
| 21.2.6 | 1 / 0 | |
| 21.2.5 | 1 / 0 | |
| 21.2.4 | 1 / 0 | |
| 20.3.19 | 1 / 0 | |
| 20.3.18 | 1 / 0 | |
| 19.2.23 | 1 / 0 | |
| 19.2.22 | 1 / 0 | |
| 19.2.21 | 1 / 0 | |
| 19.2.20 | 1 / 0 |
v21.2.15
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v21.2.14
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: google-wombot.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v21.2.13
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v21.2.12
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v21.2.11
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v21.2.10
2 findingsPackage name '@angular/core' is 1 edit(s) away from popular package 'cors'.
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v21.2.9
2 findingsPackage name '@angular/core' is 1 edit(s) away from popular package 'cors'.
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v21.2.8
2 findingsPackage name '@angular/core' is 1 edit(s) away from popular package 'cors'.
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v21.2.7
2 findingsPackage name '@angular/core' is 1 edit(s) away from popular package 'cors'.
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v21.2.6
2 findingsPackage name '@angular/core' is 1 edit(s) away from popular package 'cors'.
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v21.2.5
4 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v21.2.4
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v20.3.19
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v20.3.18
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v19.2.23
2 findingsNewly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v19.2.22
3 findingsNewly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v19.2.21
2 findingsPackage name '@angular/core' is 1 edit(s) away from popular package 'cors'.
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v19.2.20
2 findingsPackage name '@angular/core' is 1 edit(s) away from popular package 'cors'.
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.