@builder.io/dev-tools
Builder.io Visual CMS Devtools
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| phantom-deps | phantom-dep:chokidar | AI (phantom-deps): Phantom dep pattern is stable for this package. | ai | |
| phantom-deps | phantom-dep:ignore | AI (phantom-deps): Phantom dep pattern is stable for this package. | ai | |
| phantom-deps | phantom-dep:zod | AI (phantom-deps): Phantom dep pattern is stable for this package; deps referenced via config conventions. | ai | |
| publish-pattern | rapid-publish | AI (publish-pattern): Automated CI/CD pipeline for a high-velocity package (2460 versions); rapid successive publishes are expected. | ai | |
| provenance | publisher-changed | AI (provenance): Builder.io migrated publishing to GitHub Actions CI; consistent with org-level automation across their many packages. | ai | |
| source-diff | obfuscated-file:types/cli/utils/repo-indexing-group-prompts.d.ts | AI (source-diff): Long-line .d.ts file contains a readable LLM prompt string constant, not obfuscated/minified code. | ai | |
| dependencies | unvetted-dep:http-proxy | AI (dependencies): http-proxy is a well-established library; stable dependency for this package across many versions. | ai | |
| publish-pattern | new-deps-added | AI (publish-pattern): zod is a well-established validation library; addition is benign for this package. | ai | |
| source-diff | obfuscated-file:types/cli/utils/repo-indexing-agent-prompt.d.ts | AI (source-diff): Same pattern — exported prompt template string in a .d.ts file, not obfuscation. | ai | |
| source-diff | obfuscated-file:types/cli/utils/component-group-mdx-prompt.d.ts | AI (source-diff): Long-line .d.ts files are LLM prompt string constants, not obfuscated code; pattern stable for this package. | ai | |
| maintainer-change | maintainer-added | AI (maintainer-change): Large org package with frequent releases; new maintainer addition consistent with team growth, not compromise. | ai | |
| phantom-deps | phantom-dep:http-proxy-middleware | AI (phantom-deps): Proxy middleware is a documented feature; dynamic loading pattern is expected for this dev-tools package. | ai | |
| phantom-deps | phantom-dep:@vscode/ripgrep | AI (phantom-deps): IDE integration dep; conditionally loaded in dev-tools context, not a direct import. | ai | |
| phantom-deps | phantom-dep:http-proxy | AI (phantom-deps): Proxy functionality is a documented feature of this dev-tools package; dynamic loading pattern is expected. | ai | |
| phantom-deps | phantom-dep:express | AI (phantom-deps): Dev-tools package; express is a peer/optional runtime dep loaded dynamically, not a direct import. | ai | |
| provenance | no-provenance | AI (provenance): Established package; provenance is a best-practice enhancement, not a security blocker. | ai | |
| semgrep | semgrep:base64-decode | AI (semgrep): Same context as hex-decode — dotenv parsing code, not malicious payload handling. | ai | |
| semgrep | semgrep:hex-decode | AI (semgrep): Sample shows dotenv escape sequence parsing (\r, \n handling), not malicious payload decoding. | ai | |
| semgrep | semgrep:env-bulk-read | AI (semgrep): Bundled dotenv/config library code reading process.env keys — standard behavior for a dev-tools package that manages environment configuration. | ai | |
| semgrep | semgrep:child-process-spawn | AI (semgrep): Same rationale as child-process-import — legitimate dev-tools usage for spawning build/CLI processes. | ai | |
| semgrep | semgrep:child-process-import | AI (semgrep): Dev-tools package legitimately spawns child processes for build tooling, CLI commands. Bundled minified code context shows standard tooling usage, not malicious behavior. | ai | |
| phantom-deps | phantom-dep:tsx | AI (phantom-deps): tsx is a common TypeScript execution tool referenced in dev-tools config files; phantom-dep pattern is expected for this package type. | ai | |
| dependencies | unvetted-dep:@lvce-editor/ripgrep | AI (dependencies): @lvce-editor/ripgrep is a ripgrep binary wrapper appropriate for a dev-tools package doing file search; its use is consistent with the package's purpose. | ai | |
| phantom-deps | phantom-dep:http-proxy-3 | AI (phantom-deps): http-proxy-3 referenced in config files for dev server proxying is expected behavior for a dev-tools package. | ai | |
| phantom-deps | phantom-dep:@lvce-editor/ripgrep | AI (phantom-deps): Consistent with the dependency finding; conditionally loaded in config, appropriate for dev-tools file search functionality. | ai | |
| phantom-deps | phantom-dep:@types/ws | AI (phantom-deps): Type-only package loaded by convention in dev-tools context; not a security concern. | ai | |
| phantom-deps | phantom-dep:glob | AI (phantom-deps): Dev-tools package; phantom deps are config-referenced optional/conditional imports, not a security concern for this package. | ai | |
| dependencies | unvetted-dep:@amplitude/analytics-node | AI (dependencies): Official Amplitude analytics SDK; standard telemetry dependency for dev tools. Legitimate use. | ai | |
| dependencies | unvetted-dep:launch-editor | AI (dependencies): launch-editor is a well-known utility used by major dev tools (Vue CLI, CRA) to open files in editors; legitimate use in dev-tools context. | ai | |
| phantom-deps | phantom-dep:@tootallnate/quickjs-emscripten | AI (phantom-deps): Dev-tools package; phantom deps are config-referenced optional/conditional imports, not a security concern for this package. | ai | |
| phantom-deps | phantom-dep:utf-8-validate | AI (phantom-deps): Dev-tools package; phantom deps are config-referenced optional/conditional imports, not a security concern for this package. | ai | |
| phantom-deps | phantom-dep:@clack/prompts | AI (phantom-deps): Dev-tools package; phantom deps are config-referenced optional/conditional imports, not a security concern for this package. | ai | |
| phantom-deps | phantom-dep:cookie-parser | AI (phantom-deps): Dev-tools package; phantom deps are config-referenced optional/conditional imports, not a security concern for this package. | ai | |
| phantom-deps | phantom-dep:pac-resolver | AI (phantom-deps): Dev-tools package; phantom deps are config-referenced optional/conditional imports, not a security concern for this package. | ai | |
| phantom-deps | phantom-dep:cli-progress | AI (phantom-deps): Dev-tools package; phantom deps are config-referenced optional/conditional imports, not a security concern for this package. | ai | |
| phantom-deps | phantom-dep:detect-port | AI (phantom-deps): Dev-tools package; phantom deps are config-referenced optional/conditional imports, not a security concern for this package. | ai | |
| phantom-deps | phantom-dep:strip-ansi | AI (phantom-deps): Dev-tools package; phantom deps are config-referenced optional/conditional imports, not a security concern for this package. | ai | |
| phantom-deps | phantom-dep:micromatch | AI (phantom-deps): Dev-tools package; phantom deps are config-referenced optional/conditional imports, not a security concern for this package. | ai | |
| phantom-deps | phantom-dep:bufferutil | AI (phantom-deps): Dev-tools package; phantom deps are config-referenced optional/conditional imports, not a security concern for this package. | ai | |
| phantom-deps | phantom-dep:get-port | AI (phantom-deps): Dev-tools package; phantom deps are config-referenced optional/conditional imports, not a security concern for this package. | ai | |
| phantom-deps | phantom-dep:prompts | AI (phantom-deps): Dev-tools package; phantom deps are config-referenced optional/conditional imports, not a security concern for this package. | ai | |
| phantom-deps | phantom-dep:open | AI (phantom-deps): Dev-tools package; phantom deps are config-referenced optional/conditional imports, not a security concern for this package. | ai | |
| npm-metadata | bundled-binaries | AI (npm-metadata): Bundled binaries are ripgrep (rg/rg.exe) — a well-known open-source search tool. Bundling platform-specific ripgrep binaries is a standard pattern for dev tools requiring fast file search. | ai | |
| semgrep | semgrep:api-obfuscation-reflect | AI (semgrep): Reflect.get() in bundled CJS output is a common pattern in transpiled/bundled JavaScript frameworks. No evidence of malicious intent in the code samples. | ai | |
| semgrep | semgrep:new-function-constructor | AI (semgrep): Appears in bundled/minified CJS output (node/index.cjs). Code context shows template literal parsing (Babel/parser internals), not dynamic code execution of untrusted input. | ai |
Versions (showing 100 of 514)
| Version | Deps | Published |
|---|---|---|
| 1.6.147 | 24 / 3 | |
| 1.6.146 | 24 / 3 | |
| 1.6.145 | 24 / 3 | |
| 1.6.144 | 24 / 3 | |
| 1.6.143 | 24 / 3 | |
| 1.6.142 | 24 / 3 | |
| 1.6.141 | 24 / 3 | |
| 1.6.140 | 24 / 3 | |
| 1.6.139 | 24 / 3 | |
| 1.6.138 | 24 / 3 | |
| 1.6.136 | 24 / 3 | |
| 1.6.135 | 24 / 3 | |
| 1.6.134 | 24 / 3 | |
| 1.6.133 | 24 / 3 | |
| 1.6.132 | 24 / 3 | |
| 1.6.131 | 24 / 3 | |
| 1.6.130 | 24 / 3 | |
| 1.6.129 | 24 / 3 | |
| 1.6.128 | 24 / 3 | |
| 1.6.127 | 24 / 3 | |
| 1.6.126 | 23 / 2 | |
| 1.6.125 | 23 / 2 | |
| 1.6.124 | 23 / 2 | |
| 1.6.123 | 23 / 2 | |
| 1.6.122 | 23 / 2 | |
| 1.6.121 | 23 / 2 | |
| 1.6.120 | 23 / 2 | |
| 1.6.119 | 23 / 2 | |
| 1.6.118 | 23 / 2 | |
| 1.6.117 | 23 / 2 | |
| 1.6.116 | 23 / 2 | |
| 1.6.115 | 23 / 2 | |
| 1.6.112 | 23 / 2 | |
| 1.6.111 | 23 / 2 | |
| 1.6.110 | 23 / 2 | |
| 1.6.109 | 23 / 2 | |
| 1.6.108 | 23 / 2 | |
| 1.6.107 | 23 / 2 | |
| 1.6.105 | 22 / 2 | |
| 1.6.104 | 22 / 2 | |
| 1.6.103 | 22 / 2 | |
| 1.6.102 | 22 / 2 | |
| 1.6.101 | 22 / 2 | |
| 1.6.100 | 22 / 2 | |
| 1.6.99 | 22 / 2 | |
| 1.6.98 | 22 / 2 | |
| 1.6.97 | 22 / 2 | |
| 1.6.96 | 22 / 2 | |
| 1.6.95 | 22 / 2 | |
| 1.6.94 | 22 / 2 | |
| 1.6.93 | 22 / 2 | |
| 1.6.92 | 22 / 2 | |
| 1.6.90 | 22 / 2 | |
| 1.6.89 | 22 / 2 | |
| 1.6.88 | 22 / 2 | |
| 1.6.87 | 22 / 2 | |
| 1.6.86 | 22 / 2 | |
| 1.6.85 | 22 / 1 | |
| 1.6.84 | 22 / 1 | |
| 1.6.83 | 22 / 1 | |
| 1.6.82 | 22 / 1 | |
| 1.6.81 | 22 / 1 | |
| 1.6.80 | 22 / 1 | |
| 1.6.79 | 22 / 1 | |
| 1.6.78 | 22 / 1 | |
| 1.6.77 | 22 / 1 | |
| 1.6.76 | 22 / 1 | |
| 1.6.75 | 22 / 1 | |
| 1.6.74 | 22 / 1 | |
| 1.6.73 | 22 / 1 | |
| 1.6.72 | 22 / 1 | |
| 1.6.71 | 22 / 1 | |
| 1.6.70 | 22 / 1 | |
| 1.6.69 | 22 / 1 | |
| 1.6.68 | 22 / 1 | |
| 1.6.67 | 22 / 1 | |
| 1.6.66 | 22 / 1 | |
| 1.6.65 | 22 / 1 | |
| 1.6.63 | 22 / 1 | |
| 1.6.62 | 22 / 1 | |
| 1.6.61 | 22 / 1 | |
| 1.6.60 | 22 / 1 | |
| 1.6.59 | 22 / 1 | |
| 1.6.58 | 22 / 1 | |
| 1.6.57 | 22 / 1 | |
| 1.6.56 | 22 / 1 | |
| 1.6.55 | 22 / 1 | |
| 1.6.54 | 22 / 1 | |
| 1.6.53 | 22 / 1 | |
| 1.6.52 | 22 / 1 | |
| 1.6.51 | 22 / 1 | |
| 1.6.50 | 22 / 1 | |
| 1.6.49 | 22 / 1 | |
| 1.6.48 | 22 / 1 | |
| 1.6.47 | 22 / 1 | |
| 1.6.46 | 22 / 1 | |
| 1.6.45 | 22 / 1 | |
| 1.6.44 | 22 / 1 | |
| 1.6.43 | 22 / 1 | |
| 1.6.42 | 22 / 1 |
v1.6.147
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.6.146
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.6.145
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.6.144
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.6.143
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.6.142
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.6.141
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.6.140
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.6.139
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.6.138
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.6.136
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.6.135
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.6.134
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.6.133
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.6.132
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.6.131
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.6.130
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.6.129
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.6.128
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.6.127
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.6.126
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.6.125
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.6.124
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.6.123
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.6.122
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.6.121
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.6.120
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.6.119
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.6.118
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.6.117
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.6.116
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.6.115
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.6.112
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.6.111
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.6.110
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.6.109
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.6.108
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.6.107
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.6.105
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.6.104
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.6.103
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.6.102
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.6.101
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.6.100
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.6.99
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.6.98
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.6.97
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.6.96
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.6.95
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.6.94
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.6.93
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.6.92
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.6.90
3 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.6.89
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.6.88
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.6.87
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.6.86
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.6.85
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.6.84
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.6.83
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.6.82
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.6.81
2 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.6.80
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.6.79
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.6.78
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.6.77
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.6.76
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.6.75
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.6.74
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.6.73
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.6.71
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.6.70
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.6.69
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.6.68
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.6.67
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.6.66
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.6.65
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.6.63
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.6.62
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.6.61
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.6.60
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.6.59
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.6.58
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.6.57
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.6.56
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.6.55
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.6.54
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.6.53
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.6.52
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.6.51
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.6.50
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.6.49
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.6.48
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.6.47
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.6.46
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.6.45
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.6.44
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.6.43
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.6.42
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.