@forwardimpact/libresource
Supply chain provenance
Status for the latest visible version.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| phantom-deps | phantom-dep:rdf-canonize | AI (phantom-deps): rdf-canonize is a transitive/config-referenced dep in an RDF processing library; not a direct import by design. | ai | |
| phantom-deps | phantom-dep:@forwardimpact/libllm | AI (phantom-deps): Same-org sibling dep; declared but may be used transitively or conditionally — stable false positive for this package. | ai |
Versions (showing 19 of 19)
| Version | Deps | Published |
|---|---|---|
| 0.1.116 | 13 / 1 | |
| 0.1.115 | 13 / 1 | |
| 0.1.114 | 14 / 1 | |
| 0.1.113 | 14 / 1 | |
| 0.1.112 | 13 / 1 | |
| 0.1.110 | 11 / 1 | |
| 0.1.109 | 11 / 1 | |
| 0.1.108 | 11 / 1 | |
| 0.1.107 | 11 / 1 | |
| 0.1.106 | 11 / 1 | |
| 0.1.105 | 11 / 1 | |
| 0.1.104 | 11 / 1 | |
| 0.1.102 | 12 / 1 | |
| 0.1.98 | 11 / 1 | |
| 0.1.97 | 7 / 5 | |
| 0.1.93 | 7 / 5 | |
| 0.1.92 | 7 / 5 | |
| 0.1.91 | 7 / 5 | |
| 0.1.90 | 7 / 5 |
v0.1.116
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.1.115
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.1.114
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.1.113
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.1.112
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.1.110
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.1.109
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.1.108
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.1.107
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.1.106
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.1.105
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.1.104
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.1.102
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.1.98
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.1.97
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.1.93
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.1.92
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.1.91
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.1.90
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.