@biomejs/biome
Supply chain provenance
Status for the latest visible version.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| phantom-deps | phantom-dep:@biomejs/cli-darwin-arm64 | AI (phantom-deps): Platform-specific optional binary dependency; not directly imported by design. Standard pattern for native CLI tool distribution. | ai | |
| phantom-deps | phantom-dep:@biomejs/cli-linux-x64 | AI (phantom-deps): Platform-specific optional binary dependency; not directly imported by design. Standard pattern for native CLI tool distribution. | ai | |
| phantom-deps | phantom-dep:@biomejs/cli-win32-x64 | AI (phantom-deps): Platform-specific optional binary dependency; not directly imported by design. Standard pattern for native CLI tool distribution. | ai | |
| phantom-deps | phantom-dep:@biomejs/cli-darwin-x64 | AI (phantom-deps): Platform-specific optional binary dependency; not directly imported by design. Standard pattern for native CLI tool distribution. | ai | |
| phantom-deps | phantom-dep:@biomejs/cli-linux-arm64 | AI (phantom-deps): Platform-specific optional binary dependency; not directly imported by design. Standard pattern for native CLI tool distribution. | ai | |
| phantom-deps | phantom-dep:@biomejs/cli-win32-arm64 | AI (phantom-deps): Platform-specific optional binary dependency; not directly imported by design. Standard pattern for native CLI tool distribution. | ai | |
| maintainer-change | maintainer-removed | AI (maintainer-change): Routine team change in a large open-source project; SLSA provenance attestation confirms CI/CD publication integrity regardless of individual maintainer roster changes. | ai | |
| provenance | missing-githead | AI (provenance): Package has SLSA provenance attestation (Sigstore) which provides stronger supply chain integrity than gitHead. The publishConfig explicitly sets provenance:true; missing gitHead is a benign CI pipeline change. | ai | |
| install-scripts | install-script:postinstall | AI (install-scripts): Biome's postinstall selects the correct platform-specific prebuilt binary from optional deps — standard pattern for native CLI tools, stable across versions. | ai | |
| semgrep | semgrep:child-process-import | AI (semgrep): execSync is used in postinstall.js solely to detect musl libc for binary selection; not a malicious use of child_process. Stable for this package. | ai | |
| provenance | publisher-changed | AI (provenance): Biome migrated to GitHub Actions CI/CD publishing with SLSA provenance attestation, as evidenced by publishConfig.provenance=true. This is a legitimate, documented transition — not a takeover. | ai | |
| provenance | slsa-provenance | AI (provenance): SLSA provenance attestation is present and expected for this package going forward; this is a positive supply chain signal. | ai |
Versions (showing 51 of 62)
| Version | Deps | Published |
|---|---|---|
| 2.4.16 | 0 / 0 | |
| 2.4.15 | 0 / 0 | |
| 2.4.14 | 0 / 0 | |
| 2.4.13 | 0 / 0 | |
| 2.4.12 | 0 / 0 | |
| 2.4.11 | 0 / 0 | |
| 2.4.10 | 0 / 0 | |
| 2.4.9 | 0 / 0 | |
| 2.4.8 | 0 / 0 | |
| 2.4.7 | 0 / 0 | |
| 2.4.6 | 0 / 0 | |
| 2.4.5 | 0 / 0 | |
| 2.4.4 | 0 / 0 | |
| 2.4.3 | 0 / 0 | |
| 2.4.2 | 0 / 0 | |
| 2.4.1 | 0 / 0 | |
| 2.4.0 | 0 / 0 | |
| 2.3.15 | 0 / 0 | |
| 2.3.14 | 0 / 0 | |
| 2.3.13 | 0 / 0 | |
| 2.3.12 | 0 / 0 | |
| 2.3.11 | 0 / 0 | |
| 2.3.10 | 0 / 0 | |
| 2.3.9 | 0 / 0 | |
| 2.3.8 | 0 / 0 | |
| 2.3.7 | 0 / 0 | |
| 2.3.6 | 0 / 0 | |
| 2.3.5 | 0 / 0 | |
| 2.3.4 | 0 / 0 | |
| 2.3.3 | 0 / 0 | |
| 2.3.2 | 0 / 0 | |
| 2.3.1 | 0 / 0 | |
| 2.3.0 | 0 / 0 | |
| 2.2.7 | 0 / 0 | |
| 2.2.6 | 0 / 0 | |
| 2.2.5 | 0 / 0 | |
| 2.2.4 | 0 / 0 | |
| 2.2.3 | 0 / 0 | |
| 2.2.2 | 0 / 0 | |
| 2.2.0 | 0 / 0 | |
| 2.1.4 | 0 / 0 | |
| 2.1.3 | 0 / 0 | |
| 2.1.2 | 0 / 0 | |
| 2.1.1 | 0 / 0 | |
| 2.1.0 | 0 / 0 | |
| 2.0.6 | 0 / 0 | |
| 2.0.5 | 0 / 0 | |
| 2.0.4 | 0 / 0 | |
| 2.0.3 | 0 / 0 | |
| 2.0.2 | 0 / 0 | |
| 2.0.1 | 0 / 0 |
v2.4.16
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v2.4.15
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v2.4.14
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v2.4.13
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v2.4.12
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v2.4.11
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v2.4.10
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v2.4.9
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v2.4.8
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v2.4.7
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v2.4.6
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v2.4.5
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v2.4.4
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v2.4.3
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v2.4.2
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v2.4.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v2.4.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v2.3.15
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v2.3.14
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v2.3.13
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v2.3.12
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v2.3.11
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v2.3.10
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v2.3.9
2 findingsThis version was published by a different npm account than previous versions on 2025-12-15. This could indicate a legitimate maintainer transition or an account compromise.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v2.3.8
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v2.3.7
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v2.3.6
2 findingsThis version was published by a different npm account than previous versions on 2025-11-17. This could indicate a legitimate maintainer transition or an account compromise.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v2.3.5
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v2.3.4
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v2.3.3
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v2.3.2
2 findingsThis version was published by a different npm account than previous versions on 2025-10-28. This could indicate a legitimate maintainer transition or an account compromise.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v2.3.1
2 findingsThis version was published by a different npm account than previous versions on 2025-10-26. This could indicate a legitimate maintainer transition or an account compromise.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v2.3.0
2 findingsThis version was published by a different npm account than previous versions on 2025-10-24. This could indicate a legitimate maintainer transition or an account compromise.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v2.2.7
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v2.2.6
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v2.2.5
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v2.2.4
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v2.2.3
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v2.2.2
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v2.2.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v2.1.4
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v2.1.3
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v2.1.2
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v2.1.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v2.1.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v2.0.6
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v2.0.5
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v2.0.4
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v2.0.3
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v2.0.2
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: dominionl.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v2.0.1
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: dominionl.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.