@firebase/analytics-compat
This is the compatibility layer for the Firebase Analytics component of the Firebase JS SDK.
47
Versions
Apache-2.0
License
No
Install Scripts
Missing
Provenance
Supply chain provenance
Status for the latest visible version.
No SLSA provenance
npm registry signatures
gitHead linked
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
firebase-opsfeiyang.chengoogle-wombotchholland
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| dependencies | unvetted-dep:@firebase/util | AI (dependencies): @firebase/util is a first-party Firebase package from the same Google/Firebase org; not a supply chain risk for this package. | ai | |
| provenance | no-provenance | AI (provenance): Official Firebase SDK packages published by google-wombot consistently lack Sigstore provenance; this is expected for this publisher. | ai | |
| provenance | publisher-changed | AI (provenance): feiyang.chen is a long-standing Firebase/Google team publisher (2779 days, 49 packages, 1077 approved). Publisher rotation within the Firebase team is expected and not indicative of compromise. | ai | |
| bogus-package | bogus-package | AI (bogus-package): Firebase SDK monorepo sub-packages intentionally have minimal READMEs and no keywords; this is a structural pattern across all @firebase/* packages, not a spam indicator. | ai | |
| phantom-deps | phantom-dep:tslib | AI (phantom-deps): tslib is a standard TypeScript runtime helper bundled via rollup in Firebase SDK packages; phantom detection is a false positive for this build pattern. | ai | |
| phantom-deps | phantom-dep:@firebase/util | AI (phantom-deps): Same-org sibling dependency; phantom detection is a false positive for Firebase monorepo build patterns where bundling handles imports. | ai |
Versions (showing 47 of 47)
| Version | Deps | Published |
|---|---|---|
| 0.2.28 | 5 / 5 | |
| 0.2.27 | 5 / 5 | |
| 0.2.26 | 5 / 5 | |
| 0.2.25 | 5 / 5 | |
| 0.2.24 | 5 / 5 | |
| 0.2.23 | 5 / 5 | |
| 0.2.22 | 5 / 5 | |
| 0.2.21 | 5 / 5 | |
| 0.2.20 | 5 / 5 | |
| 0.2.19 | 5 / 5 | |
| 0.2.18 | 5 / 5 | |
| 0.2.17 | 5 / 5 | |
| 0.2.16 | 5 / 5 | |
| 0.2.15 | 5 / 5 | |
| 0.2.14 | 5 / 5 | |
| 0.2.13 | 5 / 5 | |
| 0.2.12 | 5 / 5 | |
| 0.2.11 | 5 / 5 | |
| 0.2.10 | 5 / 5 | |
| 0.2.9 | 5 / 5 | |
| 0.2.8 | 5 / 5 | |
| 0.2.7 | 5 / 5 | |
| 0.2.6 | 5 / 5 | |
| 0.2.5 | 5 / 5 | |
| 0.2.4 | 5 / 5 | |
| 0.2.3 | 5 / 5 | |
| 0.2.2 | 5 / 5 | |
| 0.2.1 | 5 / 5 | |
| 0.2.0 | 5 / 5 | |
| 0.1.17 | 5 / 5 | |
| 0.1.16 | 5 / 5 | |
| 0.1.15 | 5 / 5 | |
| 0.1.14 | 5 / 5 | |
| 0.1.13 | 5 / 5 | |
| 0.1.12 | 5 / 5 | |
| 0.1.11 | 5 / 5 | |
| 0.1.10 | 5 / 5 | |
| 0.1.9 | 5 / 5 | |
| 0.1.8 | 5 / 5 | |
| 0.1.7 | 5 / 5 | |
| 0.1.6 | 5 / 5 | |
| 0.1.5 | 5 / 5 | |
| 0.1.4 | 5 / 5 | |
| 0.1.3 | 5 / 5 | |
| 0.1.2 | 5 / 5 | |
| 0.1.1 | 5 / 5 | |
| 0.1.0 | 5 / 5 |
v0.2.28
1 finding
INFO
No provenance attestation
provenance
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.