@builder.io/dev-tools
Builder.io Visual CMS Devtools
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| phantom-deps | phantom-dep:chokidar | AI (phantom-deps): Phantom dep pattern is stable for this package. | ai | |
| phantom-deps | phantom-dep:ignore | AI (phantom-deps): Phantom dep pattern is stable for this package. | ai | |
| phantom-deps | phantom-dep:zod | AI (phantom-deps): Phantom dep pattern is stable for this package; deps referenced via config conventions. | ai | |
| publish-pattern | rapid-publish | AI (publish-pattern): Automated CI/CD pipeline for a high-velocity package (2460 versions); rapid successive publishes are expected. | ai | |
| provenance | publisher-changed | AI (provenance): Builder.io migrated publishing to GitHub Actions CI; consistent with org-level automation across their many packages. | ai | |
| source-diff | obfuscated-file:types/cli/utils/repo-indexing-group-prompts.d.ts | AI (source-diff): Long-line .d.ts file contains a readable LLM prompt string constant, not obfuscated/minified code. | ai | |
| dependencies | unvetted-dep:http-proxy | AI (dependencies): http-proxy is a well-established library; stable dependency for this package across many versions. | ai | |
| publish-pattern | new-deps-added | AI (publish-pattern): zod is a well-established validation library; addition is benign for this package. | ai | |
| source-diff | obfuscated-file:types/cli/utils/repo-indexing-agent-prompt.d.ts | AI (source-diff): Same pattern — exported prompt template string in a .d.ts file, not obfuscation. | ai | |
| source-diff | obfuscated-file:types/cli/utils/component-group-mdx-prompt.d.ts | AI (source-diff): Long-line .d.ts files are LLM prompt string constants, not obfuscated code; pattern stable for this package. | ai | |
| maintainer-change | maintainer-added | AI (maintainer-change): Large org package with frequent releases; new maintainer addition consistent with team growth, not compromise. | ai | |
| phantom-deps | phantom-dep:http-proxy-middleware | AI (phantom-deps): Proxy middleware is a documented feature; dynamic loading pattern is expected for this dev-tools package. | ai | |
| phantom-deps | phantom-dep:@vscode/ripgrep | AI (phantom-deps): IDE integration dep; conditionally loaded in dev-tools context, not a direct import. | ai | |
| phantom-deps | phantom-dep:http-proxy | AI (phantom-deps): Proxy functionality is a documented feature of this dev-tools package; dynamic loading pattern is expected. | ai | |
| phantom-deps | phantom-dep:express | AI (phantom-deps): Dev-tools package; express is a peer/optional runtime dep loaded dynamically, not a direct import. | ai | |
| provenance | no-provenance | AI (provenance): Established package; provenance is a best-practice enhancement, not a security blocker. | ai | |
| semgrep | semgrep:base64-decode | AI (semgrep): Same context as hex-decode — dotenv parsing code, not malicious payload handling. | ai | |
| semgrep | semgrep:hex-decode | AI (semgrep): Sample shows dotenv escape sequence parsing (\r, \n handling), not malicious payload decoding. | ai | |
| semgrep | semgrep:env-bulk-read | AI (semgrep): Bundled dotenv/config library code reading process.env keys — standard behavior for a dev-tools package that manages environment configuration. | ai | |
| semgrep | semgrep:child-process-spawn | AI (semgrep): Same rationale as child-process-import — legitimate dev-tools usage for spawning build/CLI processes. | ai | |
| semgrep | semgrep:child-process-import | AI (semgrep): Dev-tools package legitimately spawns child processes for build tooling, CLI commands. Bundled minified code context shows standard tooling usage, not malicious behavior. | ai | |
| phantom-deps | phantom-dep:tsx | AI (phantom-deps): tsx is a common TypeScript execution tool referenced in dev-tools config files; phantom-dep pattern is expected for this package type. | ai | |
| dependencies | unvetted-dep:@lvce-editor/ripgrep | AI (dependencies): @lvce-editor/ripgrep is a ripgrep binary wrapper appropriate for a dev-tools package doing file search; its use is consistent with the package's purpose. | ai | |
| phantom-deps | phantom-dep:http-proxy-3 | AI (phantom-deps): http-proxy-3 referenced in config files for dev server proxying is expected behavior for a dev-tools package. | ai | |
| phantom-deps | phantom-dep:@lvce-editor/ripgrep | AI (phantom-deps): Consistent with the dependency finding; conditionally loaded in config, appropriate for dev-tools file search functionality. | ai | |
| phantom-deps | phantom-dep:@types/ws | AI (phantom-deps): Type-only package loaded by convention in dev-tools context; not a security concern. | ai | |
| phantom-deps | phantom-dep:glob | AI (phantom-deps): Dev-tools package; phantom deps are config-referenced optional/conditional imports, not a security concern for this package. | ai | |
| dependencies | unvetted-dep:@amplitude/analytics-node | AI (dependencies): Official Amplitude analytics SDK; standard telemetry dependency for dev tools. Legitimate use. | ai | |
| dependencies | unvetted-dep:launch-editor | AI (dependencies): launch-editor is a well-known utility used by major dev tools (Vue CLI, CRA) to open files in editors; legitimate use in dev-tools context. | ai | |
| phantom-deps | phantom-dep:@tootallnate/quickjs-emscripten | AI (phantom-deps): Dev-tools package; phantom deps are config-referenced optional/conditional imports, not a security concern for this package. | ai | |
| phantom-deps | phantom-dep:utf-8-validate | AI (phantom-deps): Dev-tools package; phantom deps are config-referenced optional/conditional imports, not a security concern for this package. | ai | |
| phantom-deps | phantom-dep:@clack/prompts | AI (phantom-deps): Dev-tools package; phantom deps are config-referenced optional/conditional imports, not a security concern for this package. | ai | |
| phantom-deps | phantom-dep:cookie-parser | AI (phantom-deps): Dev-tools package; phantom deps are config-referenced optional/conditional imports, not a security concern for this package. | ai | |
| phantom-deps | phantom-dep:pac-resolver | AI (phantom-deps): Dev-tools package; phantom deps are config-referenced optional/conditional imports, not a security concern for this package. | ai | |
| phantom-deps | phantom-dep:cli-progress | AI (phantom-deps): Dev-tools package; phantom deps are config-referenced optional/conditional imports, not a security concern for this package. | ai | |
| phantom-deps | phantom-dep:detect-port | AI (phantom-deps): Dev-tools package; phantom deps are config-referenced optional/conditional imports, not a security concern for this package. | ai | |
| phantom-deps | phantom-dep:strip-ansi | AI (phantom-deps): Dev-tools package; phantom deps are config-referenced optional/conditional imports, not a security concern for this package. | ai | |
| phantom-deps | phantom-dep:micromatch | AI (phantom-deps): Dev-tools package; phantom deps are config-referenced optional/conditional imports, not a security concern for this package. | ai | |
| phantom-deps | phantom-dep:bufferutil | AI (phantom-deps): Dev-tools package; phantom deps are config-referenced optional/conditional imports, not a security concern for this package. | ai | |
| phantom-deps | phantom-dep:get-port | AI (phantom-deps): Dev-tools package; phantom deps are config-referenced optional/conditional imports, not a security concern for this package. | ai | |
| phantom-deps | phantom-dep:prompts | AI (phantom-deps): Dev-tools package; phantom deps are config-referenced optional/conditional imports, not a security concern for this package. | ai | |
| phantom-deps | phantom-dep:open | AI (phantom-deps): Dev-tools package; phantom deps are config-referenced optional/conditional imports, not a security concern for this package. | ai | |
| npm-metadata | bundled-binaries | AI (npm-metadata): Bundled binaries are ripgrep (rg/rg.exe) — a well-known open-source search tool. Bundling platform-specific ripgrep binaries is a standard pattern for dev tools requiring fast file search. | ai | |
| semgrep | semgrep:api-obfuscation-reflect | AI (semgrep): Reflect.get() in bundled CJS output is a common pattern in transpiled/bundled JavaScript frameworks. No evidence of malicious intent in the code samples. | ai | |
| semgrep | semgrep:new-function-constructor | AI (semgrep): Appears in bundled/minified CJS output (node/index.cjs). Code context shows template literal parsing (Babel/parser internals), not dynamic code execution of untrusted input. | ai |
Versions (showing 100 of 514)
| Version | Deps | Published |
|---|---|---|
| 1.17.27 | 26 / 3 | |
| 1.17.26 | 26 / 3 | |
| 1.17.25 | 26 / 3 | |
| 1.17.24 | 26 / 3 | |
| 1.17.23 | 26 / 3 | |
| 1.17.22 | 26 / 3 | |
| 1.17.21 | 26 / 3 | |
| 1.17.20 | 26 / 3 | |
| 1.17.19 | 26 / 3 | |
| 1.17.18 | 26 / 3 | |
| 1.17.17 | 26 / 3 | |
| 1.17.16 | 26 / 3 | |
| 1.17.15 | 26 / 3 | |
| 1.17.14 | 26 / 3 | |
| 1.17.12 | 26 / 3 | |
| 1.17.11 | 26 / 3 | |
| 1.17.10 | 26 / 3 | |
| 1.17.9 | 26 / 3 | |
| 1.17.8 | 26 / 3 | |
| 1.17.7 | 26 / 3 | |
| 1.17.6 | 26 / 3 | |
| 1.17.5 | 26 / 3 | |
| 1.17.4 | 26 / 3 | |
| 1.17.3 | 26 / 3 | |
| 1.17.2 | 26 / 3 | |
| 1.17.1 | 26 / 3 | |
| 1.17.0 | 26 / 3 | |
| 1.16.9 | 26 / 3 | |
| 1.16.8 | 26 / 3 | |
| 1.16.7 | 26 / 3 | |
| 1.16.6 | 25 / 3 | |
| 1.16.5 | 25 / 3 | |
| 1.16.4 | 25 / 3 | |
| 1.16.2 | 25 / 3 | |
| 1.16.1 | 25 / 3 | |
| 1.16.0 | 25 / 3 | |
| 1.15.2 | 25 / 3 | |
| 1.15.1 | 25 / 3 | |
| 1.15.0 | 25 / 3 | |
| 1.14.5 | 25 / 3 | |
| 1.14.4 | 25 / 3 | |
| 1.14.3 | 25 / 3 | |
| 1.14.2 | 25 / 3 | |
| 1.14.1 | 25 / 3 | |
| 1.14.0 | 25 / 3 | |
| 1.13.6 | 25 / 3 | |
| 1.13.5 | 25 / 3 | |
| 1.13.4 | 25 / 3 | |
| 1.13.3 | 25 / 3 | |
| 1.13.2 | 25 / 3 | |
| 1.13.1 | 24 / 3 | |
| 1.13.0 | 24 / 3 | |
| 1.12.8 | 24 / 3 | |
| 1.12.7 | 24 / 3 | |
| 1.12.6 | 24 / 3 | |
| 1.12.5 | 24 / 3 | |
| 1.12.4 | 24 / 3 | |
| 1.12.3 | 24 / 3 | |
| 1.12.2 | 24 / 3 | |
| 1.12.1 | 24 / 3 | |
| 1.12.0 | 24 / 3 | |
| 1.11.51 | 24 / 3 | |
| 1.11.50 | 24 / 3 | |
| 1.11.49 | 24 / 3 | |
| 1.11.48 | 24 / 3 | |
| 1.11.47 | 24 / 3 | |
| 1.11.46 | 24 / 3 | |
| 1.11.45 | 24 / 3 | |
| 1.11.44 | 24 / 3 | |
| 1.11.43 | 24 / 3 | |
| 1.11.42 | 24 / 3 | |
| 1.11.41 | 24 / 3 | |
| 1.11.40 | 25 / 3 | |
| 1.11.39 | 25 / 3 | |
| 1.11.38 | 25 / 3 | |
| 1.11.37 | 25 / 3 | |
| 1.11.36 | 25 / 3 | |
| 1.11.35 | 25 / 3 | |
| 1.11.34 | 25 / 3 | |
| 1.11.33 | 25 / 3 | |
| 1.11.32 | 25 / 3 | |
| 1.11.31 | 25 / 3 | |
| 1.11.30 | 25 / 3 | |
| 1.11.29 | 25 / 3 | |
| 1.11.28 | 25 / 3 | |
| 1.11.27 | 25 / 3 | |
| 1.11.26 | 25 / 3 | |
| 1.11.25 | 25 / 3 | |
| 1.11.24 | 25 / 3 | |
| 1.11.23 | 25 / 3 | |
| 1.11.22 | 25 / 3 | |
| 1.11.21 | 25 / 3 | |
| 1.11.20 | 25 / 3 | |
| 1.11.19 | 25 / 3 | |
| 1.11.18 | 25 / 3 | |
| 1.11.17 | 25 / 3 | |
| 1.11.16 | 25 / 3 | |
| 1.11.15 | 25 / 3 | |
| 1.11.14 | 25 / 3 | |
| 1.11.13 | 25 / 3 |
v1.17.27
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.17.26
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.17.25
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.17.24
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.17.23
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.17.22
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.17.21
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.17.20
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.17.19
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.17.18
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.17.17
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.17.16
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.17.15
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.17.14
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.17.12
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.17.11
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.17.10
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.17.9
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.17.8
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.17.7
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.17.6
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.17.5
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.17.4
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.17.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.17.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.17.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.17.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.16.9
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.16.8
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.16.7
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.16.6
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.16.5
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.16.4
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.16.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.16.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.16.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.15.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.15.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.15.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.14.5
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.14.4
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.14.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.14.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.14.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.14.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.13.6
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.13.5
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.13.4
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.13.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.13.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.13.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.13.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.12.8
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.12.7
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.12.6
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.12.5
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.12.4
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.12.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.12.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.12.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.12.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.11.51
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.11.50
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.11.49
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.11.48
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.11.47
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.11.46
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.11.45
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.11.44
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.11.43
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.11.42
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.11.41
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.11.40
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.11.39
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.11.38
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.11.37
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.11.36
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.11.35
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.11.34
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.11.33
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.11.32
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.11.31
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.11.30
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.11.29
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.11.28
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.11.27
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.11.26
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.11.25
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.11.24
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.11.23
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.11.22
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.11.21
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.11.20
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.11.19
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.11.18
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.11.17
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.11.16
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.11.15
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.11.14
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.11.13
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.