@getbrevo/brevo @3.0.4
rejected
This version was rejected.
It did not pass GreenFlagged's security review and is not served by the registry.
The findings and risk dispositions below explain why.
51
Risk Score
—
License
No
Install Scripts
3
Dependencies
3
Dev Dependencies
372.8 KB
Package Size
Published
Maintainers
shubhamupadhyayinbluemauriciobrevoantoine-sib
Dependencies (3)
| Package | Constraint | Registry Status |
|---|---|---|
| axios | ^1.6.8 | auto_approved |
| rewire | ^7.0.0 | auto_approved |
| bluebird | ^3.5.0 | auto_approved |
Dev Dependencies (3)
| Package | Constraint | Registry Status |
|---|---|---|
| typescript | ^4.0 | auto_approved |
| @types/node | ^12.20.55 | auto_approved |
| @types/bluebird | ^3.5.33 | auto_approved |
Transitive Dependency Tree
124 transitive deps
max depth 9
├─
axios
^1.6.8
→ 1.16.1
├─
bluebird
^3.5.0
→ 3.7.2
├─
rewire
^7.0.0
→ 7.0.0
├─
eslint
^8.47.0
→ 8.57.1
├─
follow-redirects
^1.16.0
→ 1.16.0
├─
form-data
^4.0.5
→ 4.0.5
├─
https-proxy-agent
^5.0.1
→ 5.0.1
├─
proxy-from-env
^2.1.0
→ 2.1.0
├─
@eslint-community/eslint-utils
^4.2.0
→ 4.9.1
├─
@eslint-community/regexpp
^4.6.1
→ 4.12.2
├─
@eslint/eslintrc
^2.1.4
→ 2.1.4
├─
@eslint/js
8.57.1
→ 8.57.1
├─
@humanwhocodes/config-array
^0.13.0
→ 0.13.0
├─
@humanwhocodes/module-importer
^1.0.1
→ 1.0.1
├─
@nodelib/fs.walk
^1.2.8
→ 1.2.8
├─
@ungap/structured-clone
^1.2.0
→ 1.3.0
├─
agent-base
6
→ 6.0.2
├─
ajv
^6.12.4
→ 6.15.0
├─
asynckit
^0.4.0
├─
chalk
^4.0.0
→ 4.1.2
├─
combined-stream
^1.0.8
→ 1.0.8
├─
cross-spawn
^7.0.2
→ 7.0.6
├─
debug
4
→ 4.4.3
├─
debug
^4.3.2
→ 4.4.3
├─
doctrine
^3.0.0
→ 3.0.0
├─
es-set-tostringtag
^2.1.0
→ 2.1.0
├─
escape-string-regexp
^4.0.0
→ 4.0.0
├─
eslint-scope
^7.2.2
→ 7.2.2
├─
eslint-visitor-keys
^3.4.3
→ 3.4.3
├─
espree
^9.6.1
→ 9.6.1
├─
esquery
^1.4.2
→ 1.7.0
├─
esutils
^2.0.2
→ 2.0.3
├─
fast-deep-equal
^3.1.3
→ 3.1.3
├─
file-entry-cache
^6.0.1
→ 6.0.1
├─
find-up
^5.0.0
→ 5.0.0
├─
glob-parent
^6.0.2
→ 6.0.2
├─
globals
^13.19.0
→ 13.24.0
├─
graphemer
^1.4.0
→ 1.4.0
├─
hasown
^2.0.2
→ 2.0.4
├─
ignore
^5.2.0
→ 5.3.2
├─
imurmurhash
^0.1.4
→ 0.1.4
├─
is-glob
^4.0.0
→ 4.0.3
├─
is-path-inside
^3.0.3
→ 3.0.3
├─
js-yaml
^4.1.0
→ 4.1.1
├─
json-stable-stringify-without-jsonify
^1.0.1
→ 1.0.1
├─
levn
^0.4.1
→ 0.4.1
├─
lodash.merge
^4.6.2
→ 4.6.2
├─
mime-types
^2.1.12
→ 2.1.35
├─
minimatch
^3.1.2
→ 3.1.5
├─
natural-compare
^1.4.0
→ 1.4.0
├─
optionator
^0.9.3
→ 0.9.4
├─
strip-ansi
^6.0.1
→ 6.0.1
├─
text-table
^0.2.0
→ 0.2.0
├─
@humanwhocodes/object-schema
^2.0.3
→ 2.0.3
├─
@nodelib/fs.scandir
2.1.5
→ 2.1.5
├─
acorn
^8.9.0
→ 8.16.0
├─
acorn-jsx
^5.3.2
→ 5.3.2
├─
ajv
^6.12.4
→ 6.15.0
├─
ansi-regex
^5.0.1
→ 5.0.1
├─
ansi-styles
^4.1.0
→ 4.3.0
├─
argparse
^2.0.1
→ 2.0.1
├─
brace-expansion
^1.1.7
→ 1.1.15
├─
debug
4
→ 4.4.3
├─
debug
^4.3.2
→ 4.4.3
├─
debug
^4.3.1
→ 4.4.3
├─
deep-is
^0.1.3
→ 0.1.4
├─
delayed-stream
~1.0.0
→ 1.0.0
├─
es-errors
^1.3.0
→ 1.3.0
├─
eslint-visitor-keys
^3.4.3
→ 3.4.3
├─
eslint-visitor-keys
^3.4.1
→ 3.4.3
├─
espree
^9.6.0
→ 9.6.1
├─
esrecurse
^4.3.0
→ 4.3.0
├─
estraverse
^5.2.0
→ 5.3.0
├─
estraverse
^5.1.0
→ 5.3.0
├─
esutils
^2.0.2
→ 2.0.3
├─
fast-deep-equal
^3.1.1
→ 3.1.3
├─
fast-json-stable-stringify
^2.0.0
→ 2.1.0
├─
fast-levenshtein
^2.0.6
→ 2.0.6
├─
fastq
^1.6.0
→ 1.20.1
├─
flat-cache
^3.0.4
→ 3.2.0
├─
function-bind
^1.1.2
→ 1.1.2
├─
get-intrinsic
^1.2.6
→ 1.3.1
├─
globals
^13.19.0
→ 13.24.0
├─
has-tostringtag
^1.0.2
→ 1.0.2
├─
hasown
^2.0.2
→ 2.0.4
├─
ignore
^5.2.0
→ 5.3.2
├─
import-fresh
^3.2.1
├─
is-extglob
^2.1.1
→ 2.1.1
├─
is-glob
^4.0.3
→ 4.0.3
├─
js-yaml
^4.1.0
→ 4.1.1
├─
json-schema-traverse
^0.4.1
→ 0.4.1
├─
levn
^0.4.1
→ 0.4.1
├─
locate-path
^6.0.0
→ 6.0.0
├─
mime-db
1.52.0
├─
minimatch
^3.0.5
→ 3.1.5
├─
minimatch
^3.1.2
→ 3.1.5
├─
ms
^2.1.3
→ 2.1.3
├─
path-exists
^4.0.0
→ 4.0.0
├─
path-key
^3.1.0
→ 3.1.1
├─
prelude-ls
^1.2.1
├─
shebang-command
^2.0.0
→ 2.0.0
├─
strip-json-comments
^3.1.1
→ 3.1.1
├─
supports-color
^7.1.0
→ 7.2.0
├─
type-check
^0.4.0
├─
type-check
~0.4.0
├─
type-fest
^0.20.2
→ 0.20.2
├─
uri-js
^4.2.2
→ 4.4.1
├─
which
^2.0.1
→ 2.0.2
├─
word-wrap
^1.2.5
→ 1.2.5
├─
@nodelib/fs.stat
2.0.5
→ 2.0.5
├─
acorn
^8.9.0
→ 8.16.0
├─
acorn-jsx
^5.3.2
→ 5.3.2
├─
argparse
^2.0.1
→ 2.0.1
├─
async-function
^1.0.0
├─
async-generator-function
^1.0.0
→ 1.0.0
├─
balanced-match
^1.0.0
→ 1.0.2
├─
brace-expansion
^1.1.7
→ 1.1.15
├─
call-bind-apply-helpers
^1.0.2
→ 1.0.2
├─
color-convert
^2.0.1
├─
concat-map
0.0.1
→ 0.0.1
├─
es-define-property
^1.0.1
→ 1.0.1
├─
es-errors
^1.3.0
→ 1.3.0
├─
es-object-atoms
^1.1.1
→ 1.1.2
├─
eslint-visitor-keys
^3.4.1
→ 3.4.3
├─
estraverse
^5.2.0
→ 5.3.0
├─
fast-deep-equal
^3.1.1
→ 3.1.3
├─
fast-json-stable-stringify
^2.0.0
→ 2.1.0
├─
flatted
^3.2.9
→ 3.4.2
├─
function-bind
^1.1.2
→ 1.1.2
├─
generator-function
^2.0.0
→ 2.0.1
├─
get-proto
^1.0.1
├─
gopd
^1.2.0
→ 1.2.0
├─
has-flag
^4.0.0
→ 4.0.0
├─
has-symbols
^1.0.3
→ 1.1.0
├─
has-symbols
^1.1.0
→ 1.1.0
├─
hasown
^2.0.2
→ 2.0.4
├─
is-extglob
^2.1.1
→ 2.1.1
├─
isexe
^2.0.0
→ 2.0.0
├─
json-schema-traverse
^0.4.1
→ 0.4.1
├─
keyv
^4.5.3
→ 4.5.4
├─
math-intrinsics
^1.1.0
→ 1.1.0
├─
ms
^2.1.3
→ 2.1.3
├─
p-locate
^5.0.0
→ 5.0.0
├─
prelude-ls
^1.2.1
├─
punycode
^2.1.0
→ 2.3.1
├─
reusify
^1.0.4
→ 1.1.0
├─
rimraf
^3.0.2
→ 3.0.2
├─
run-parallel
^1.1.9
→ 1.2.0
├─
shebang-regex
^3.0.0
├─
type-check
~0.4.0
├─
type-fest
^0.20.2
→ 0.20.2
├─
uri-js
^4.2.2
→ 4.4.1
├─
balanced-match
^1.0.0
→ 1.0.2
├─
concat-map
0.0.1
→ 0.0.1
├─
es-errors
^1.3.0
→ 1.3.0
├─
function-bind
^1.1.2
→ 1.1.2
├─
glob
^7.1.3
→ 7.1.7
├─
json-buffer
3.0.1
→ 3.0.1
├─
p-limit
^3.0.2
→ 3.1.0
├─
punycode
^2.1.0
→ 2.3.1
├─
queue-microtask
^1.2.2
→ 1.2.3
├─
fs.realpath
^1.0.0
├─
inflight
^1.0.4
├─
inherits
2
→ 2.0.4
├─
minimatch
^3.0.4
→ 3.1.5
├─
once
^1.3.0
→ 1.4.0
├─
path-is-absolute
^1.0.0
→ 1.0.1
├─
yocto-queue
^0.1.0
├─
brace-expansion
^1.1.7
→ 1.1.15
├─
wrappy
1
→ 1.0.2
├─
balanced-match
^1.0.0
→ 1.0.2
├─
concat-map
0.0.1
→ 0.0.1
Changes from v5.0.0
Dependency Changes
| Change | Package | Version |
|---|---|---|
| added | axios | ^1.6.8 |
| added | rewire | ^7.0.0 |
| added | bluebird | ^3.5.0 |
Script Changes
+ clean - lint- test- check- format- lint:fix- build:cjs- build:esm- check:fix- test:unit- test:wire- format:checkLicense Changed
none → MITFile Changes
1631 added
3109 removed
2 modified
size delta: +42.9 KB
Risk Dispositions (1 applicable to this version, 0 other)
Accepted rules are downgraded to INFO on future analyses; rejected rules escalate to CRITICAL.
| Rule | Source | Disposition | Author | Reason | |
|---|---|---|---|---|---|
regressed-provenance |
provenance | reject | AI | AI (provenance): Provenance regression from CI/CD to manual publish is a strong compromise signal for this package. |
SAST Findings (2)
HIGH
Provenance attestation missing — previous versions had it
provenance
This version was published without provenance, but prior versions were published via CI/CD with attestations. This is a strong signal of a potential account compromise or unauthorized publish. The axios attack (March 2026) exhibited exactly this pattern.
INFO
Publisher changed: GitHub Actions → shubhamupadhyayinblue (on 2026-02-26, known maintainer)
provenance
This version was published by a different npm account (shubhamupadhyayinblue) than the most recent previously approved version (GitHub Actions) on 2026-02-26, but shubhamupadhyayinblue is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
Review Summary
Risk score: 51. Findings: 1 high (+25), 2 medium (+20), 2 low (+6), 2 info (+0).
Commit: d12093153409 Browse source
Published to npm: