@firebase/component
Firebase Component Platform
51
Versions
Apache-2.0
License
No
Install Scripts
Missing
Provenance
Supply chain provenance
Status for the latest visible version.
No SLSA provenance
npm registry signatures
gitHead linked
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
firebase-opsfeiyang.chengoogle-wombotchholland
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| provenance | publisher-changed | AI (provenance): google-wombot is Google's official Firebase SDK automation account; publisher transitions from human maintainers to this bot are standard practice for the Firebase JS SDK. | ai | |
| maintainer-change | maintainer-removed | AI (maintainer-change): Removal of individual maintainers in favor of google-wombot automation is consistent with Google's Firebase SDK release process. | ai | |
| phantom-deps | phantom-dep:tslib | AI (phantom-deps): tslib is a TypeScript compiler helper injected at build time; not directly imported in source but legitimately required as a runtime dependency. Standard false positive for TypeScript packages. | ai | |
| provenance | no-provenance | AI (provenance): Official Firebase SDK package from Google; provenance attestation was not standard practice at time of publication. Stable false positive for this package. | ai |
Versions (showing 51 of 301)
| Version | Deps | Published |
|---|---|---|
| 0.7.3 | 2 / 3 | |
| 0.7.2 | 2 / 3 | |
| 0.7.1 | 2 / 3 | |
| 0.7.0 | 2 / 3 | |
| 0.6.18 | 2 / 3 | |
| 0.6.17 | 2 / 3 | |
| 0.6.16 | 2 / 3 | |
| 0.6.15 | 2 / 3 | |
| 0.6.14 | 2 / 3 | |
| 0.6.13 | 2 / 3 | |
| 0.6.12 | 2 / 3 | |
| 0.6.11 | 2 / 3 | |
| 0.6.10 | 2 / 3 | |
| 0.6.9 | 2 / 3 | |
| 0.6.8 | 2 / 3 | |
| 0.6.7 | 2 / 3 | |
| 0.6.6 | 2 / 3 | |
| 0.6.5 | 2 / 3 | |
| 0.6.4 | 2 / 3 | |
| 0.6.3 | 2 / 3 | |
| 0.6.2 | 2 / 3 | |
| 0.6.1 | 2 / 3 | |
| 0.6.0 | 2 / 3 | |
| 0.5.21 | 2 / 3 | |
| 0.5.20 | 2 / 3 | |
| 0.5.19 | 2 / 3 | |
| 0.5.18 | 2 / 3 | |
| 0.5.17 | 2 / 3 | |
| 0.5.16 | 2 / 3 | |
| 0.5.15 | 2 / 3 | |
| 0.5.14 | 2 / 3 | |
| 0.5.13 | 2 / 3 | |
| 0.5.12 | 2 / 3 | |
| 0.5.11 | 2 / 3 | |
| 0.5.10 | 2 / 3 | |
| 0.5.9 | 2 / 3 | |
| 0.5.8 | 2 / 3 | |
| 0.5.7 | 2 / 3 | |
| 0.5.6 | 2 / 3 | |
| 0.5.5 | 2 / 3 | |
| 0.5.4 | 2 / 3 | |
| 0.5.3 | 2 / 3 | |
| 0.5.2 | 2 / 3 | |
| 0.5.1 | 2 / 3 | |
| 0.5.0 | 2 / 3 | |
| 0.4.1 | 2 / 3 | |
| 0.4.0 | 2 / 3 | |
| 0.3.1 | 2 / 3 | |
| 0.3.0 | 2 / 3 | |
| 0.2.1 | 2 / 3 | |
| 0.2.0 | 2 / 3 |
v0.7.3
1 finding
INFO
No provenance attestation
provenance
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.