@firebase/performance-compat
The compatibility package of Firebase Performance
44
Versions
Apache-2.0
License
No
Install Scripts
Missing
Provenance
Supply chain provenance
Status for the latest visible version.
No SLSA provenance
npm registry signatures
gitHead linked
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
firebase-opsfeiyang.chengoogle-wombotchholland
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| dependencies | unvetted-dep:@firebase/util | AI (dependencies): @firebase/util is a same-org Firebase dependency; already flagged as accepted risk in phantom-dep finding. No real concern for this package. | ai | |
| publish-pattern | dormant-publish | AI (publish-pattern): Package is published by Google's official Firebase bot (google-wombot) with a long established history. Dormancy likely reflects release cadence changes in the Firebase SDK monorepo, not account takeover. | ai | |
| provenance | publisher-changed | AI (provenance): google-wombot is Google's official Firebase automation bot; transition from individual Google engineer accounts to this bot is standard practice for Firebase SDK releases. | ai | |
| maintainer-change | maintainer-removed | AI (maintainer-change): hiranya911 is a known Firebase team member; removal reflects Google's consolidation of publishing under google-wombot service account, not a takeover. | ai | |
| phantom-deps | phantom-dep:tslib | AI (phantom-deps): tslib is a known implicit runtime dependency for TypeScript-compiled packages; phantom flag is a stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:@firebase/util | AI (phantom-deps): First-party Firebase monorepo dependency used transitively in compat shim; not directly imported by design. | ai | |
| phantom-deps | phantom-dep:@firebase/logger | AI (phantom-deps): First-party Firebase monorepo dependency used transitively in compat shim; not directly imported by design. | ai | |
| bogus-package | bogus-package | AI (bogus-package): Firebase SDK monorepo sub-packages consistently lack keywords and detailed READMEs; this is a structural pattern, not a spam indicator. | ai | |
| provenance | no-provenance | AI (provenance): Published by google-wombot in 2021 era; Sigstore provenance was not yet standard practice for Firebase SDK canary releases. | ai |
Versions (showing 44 of 44)
| Version | Deps | Published |
|---|---|---|
| 0.2.25 | 6 / 6 | |
| 0.2.24 | 6 / 6 | |
| 0.2.23 | 6 / 6 | |
| 0.2.22 | 6 / 6 | |
| 0.2.21 | 6 / 6 | |
| 0.2.20 | 6 / 6 | |
| 0.2.19 | 6 / 6 | |
| 0.2.18 | 6 / 6 | |
| 0.2.17 | 6 / 6 | |
| 0.2.16 | 6 / 6 | |
| 0.2.15 | 6 / 6 | |
| 0.2.14 | 6 / 6 | |
| 0.2.13 | 6 / 6 | |
| 0.2.12 | 6 / 6 | |
| 0.2.11 | 6 / 6 | |
| 0.2.10 | 6 / 6 | |
| 0.2.9 | 6 / 6 | |
| 0.2.8 | 6 / 6 | |
| 0.2.7 | 6 / 6 | |
| 0.2.6 | 6 / 6 | |
| 0.2.5 | 6 / 6 | |
| 0.2.4 | 6 / 6 | |
| 0.2.3 | 6 / 6 | |
| 0.2.2 | 6 / 6 | |
| 0.2.1 | 6 / 6 | |
| 0.2.0 | 6 / 6 | |
| 0.1.17 | 6 / 6 | |
| 0.1.16 | 6 / 6 | |
| 0.1.15 | 6 / 6 | |
| 0.1.14 | 6 / 6 | |
| 0.1.13 | 6 / 6 | |
| 0.1.12 | 6 / 6 | |
| 0.1.11 | 6 / 6 | |
| 0.1.10 | 6 / 6 | |
| 0.1.9 | 6 / 6 | |
| 0.1.8 | 6 / 6 | |
| 0.1.7 | 6 / 6 | |
| 0.1.6 | 6 / 6 | |
| 0.1.5 | 6 / 6 | |
| 0.1.4 | 6 / 6 | |
| 0.1.3 | 6 / 6 | |
| 0.1.2 | 6 / 6 | |
| 0.1.1 | 6 / 6 | |
| 0.1.0 | 6 / 6 |
v0.2.25
1 finding
INFO
No provenance attestation
provenance
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.