@artilleryio/int-core
@artilleryio/int-core
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| semgrep | semgrep:dynamic-require | AI (semgrep): Dynamic require is used to load pluggable test engines by name — documented plugin-loader pattern for Artillery. | ai | |
| semgrep | semgrep:base64-decode | AI (semgrep): Base64 decode handles user-supplied binary payload data in HTTP engine; not obfuscation. | ai | |
| bogus-package | bogus-package | AI (bogus-package): Scoped internal package for Artillery; sparse metadata is expected for an internal library, not a spam indicator. | ai | |
| phantom-deps | phantom-dep:cheerio | AI (phantom-deps): Likely loaded dynamically or via plugin pattern; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:esprima | AI (phantom-deps): Used indirectly via filtrex or dynamic loading; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:csv-parse | AI (phantom-deps): Loaded dynamically for CSV payload support; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:protobufjs | AI (phantom-deps): Loaded dynamically for gRPC/protobuf engine support; stable false positive. | ai | |
| phantom-deps | phantom-dep:cookie-parser | AI (phantom-deps): Used in test server or loaded conditionally; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:deep-for-each | AI (phantom-deps): Likely loaded via dynamic require pattern; stable false positive for this package. | ai |
Versions (showing 5 of 5)
| Version | Deps | Published |
|---|---|---|
| 2.26.0 | 29 / 9 | |
| 2.23.0 | 29 / 9 | |
| 2.22.0 | 29 / 9 | |
| 2.21.0 | 29 / 9 | |
| 2.18.0 | 29 / 9 |
v2.26.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v2.23.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v2.22.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v2.21.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v2.18.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.