@gooddata/sdk-ui-gen-ai
GoodData GenAI SDK
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| provenance | no-provenance | AI (provenance): GoodData CI pipeline; no provenance is consistent across their large package portfolio. | ai | |
| email-domain | unclaimed-email:rodri360.com | AI (email-domain): Publishing account is gooddata-ci with strong track record; stale maintainer email field does not affect publish trust for this org package. | ai | |
| phantom-deps | phantom-dep:@codemirror/language | AI (phantom-deps): Referenced in config files for CodeMirror integration; stable false positive. | ai | |
| phantom-deps | phantom-dep:react-textarea-autosize | AI (phantom-deps): Referenced in config files; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:@types/mdast | AI (phantom-deps): Type-only dep for remark/mdast pipeline; stable false positive. | ai | |
| phantom-deps | phantom-dep:@gooddata/api-client-tiger | AI (phantom-deps): Same-org monorepo dep; stable false positive. | ai | |
| phantom-deps | phantom-dep:@gooddata/sdk-ui-filters | AI (phantom-deps): Same-org monorepo dep; stable false positive. | ai | |
| phantom-deps | phantom-dep:@types/unist | AI (phantom-deps): Type-only dep for unist AST types; stable false positive. | ai | |
| dependencies | unvetted-dep:@gooddata/sdk-ui-theme-provider | AI (dependencies): Same-org monorepo sibling pinned to matching version. | ai | |
| dependencies | unvetted-dep:@gooddata/sdk-ui-semantic-search | AI (dependencies): Same-org monorepo sibling pinned to matching version. | ai | |
| dependencies | unvetted-dep:@gooddata/sdk-model | AI (dependencies): Same-org monorepo sibling pinned to matching version; expected pattern for GoodData SDK releases. | ai | |
| phantom-deps | phantom-dep:reselect | AI (phantom-deps): Used transitively via @reduxjs/toolkit; common false positive. | ai | |
| phantom-deps | phantom-dep:tslib | AI (phantom-deps): Known implicit TypeScript runtime dep; stable false positive. | ai | |
| phantom-deps | phantom-dep:immer | AI (phantom-deps): Used transitively via @reduxjs/toolkit; common false positive for this dep pattern. | ai | |
| dependencies | unvetted-dep:@gooddata/sdk-ui-kit | AI (dependencies): Same-org monorepo sibling pinned to matching version. | ai | |
| dependencies | unvetted-dep:@gooddata/sdk-ui-pivot | AI (dependencies): Same-org monorepo sibling pinned to matching version. | ai | |
| dependencies | unvetted-dep:@gooddata/sdk-ui-charts | AI (dependencies): Same-org monorepo sibling pinned to matching version. | ai | |
| dependencies | unvetted-dep:@gooddata/sdk-ui-filters | AI (dependencies): Same-org monorepo sibling pinned to matching version. | ai | |
| dependencies | unvetted-dep:@gooddata/api-client-tiger | AI (dependencies): Same-org monorepo sibling pinned to matching version. | ai | |
| dependencies | unvetted-dep:@gooddata/sdk-ui-dashboard | AI (dependencies): Same-org monorepo sibling pinned to matching version. | ai | |
| dependencies | unvetted-dep:@gooddata/sdk-code-convertors | AI (dependencies): Same-org monorepo sibling pinned to matching version. | ai |
Versions (showing 41 of 41)
| Version | Deps | Published |
|---|---|---|
| 11.41.0 | 35 / 47 | |
| 11.40.0 | 35 / 47 | |
| 11.39.0 | 35 / 47 | |
| 11.38.0 | 35 / 47 | |
| 11.37.0 | 35 / 47 | |
| 11.36.0 | 35 / 47 | |
| 11.35.0 | 35 / 47 | |
| 11.34.0 | 35 / 47 | |
| 11.33.0 | 35 / 47 | |
| 11.32.0 | 35 / 47 | |
| 11.31.0 | 35 / 47 | |
| 11.30.0 | 35 / 47 | |
| 11.29.0 | 35 / 47 | |
| 11.28.0 | 36 / 47 | |
| 11.27.0 | 35 / 47 | |
| 11.24.0 | 35 / 47 | |
| 11.23.0 | 35 / 47 | |
| 11.22.0 | 35 / 47 | |
| 11.21.0 | 35 / 47 | |
| 11.20.0 | 35 / 47 | |
| 11.19.0 | 35 / 46 | |
| 11.18.0 | 35 / 47 | |
| 11.17.0 | 35 / 45 | |
| 11.16.0 | 33 / 45 | |
| 11.15.0 | 33 / 45 | |
| 11.14.0 | 33 / 45 | |
| 11.13.0 | 33 / 45 | |
| 11.12.0 | 32 / 44 | |
| 11.11.0 | 32 / 44 | |
| 11.10.0 | 31 / 44 | |
| 11.9.0 | 31 / 44 | |
| 11.8.0 | 31 / 44 | |
| 11.7.1 | 29 / 44 | |
| 11.7.0 | 29 / 44 | |
| 11.6.0 | 29 / 44 | |
| 11.5.0 | 29 / 44 | |
| 11.4.0 | 29 / 44 | |
| 11.3.0 | 29 / 45 | |
| 11.2.0 | 29 / 45 | |
| 11.1.0 | 29 / 45 | |
| 11.0.0 | 29 / 45 |
v11.41.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v11.40.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v11.39.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v11.38.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v11.37.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v11.36.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v11.35.0
2 findingsMaintainer email '[email protected]' uses domain 'rodri360.com' which has no DNS records. An attacker could register this domain to hijack the maintainer identity.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v11.34.0
2 findingsMaintainer email '[email protected]' uses domain 'rodri360.com' which has no DNS records. An attacker could register this domain to hijack the maintainer identity.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v11.33.0
2 findingsMaintainer email '[email protected]' uses domain 'rodri360.com' which has no DNS records. An attacker could register this domain to hijack the maintainer identity.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v11.32.0
2 findingsMaintainer email '[email protected]' uses domain 'rodri360.com' which has no DNS records. An attacker could register this domain to hijack the maintainer identity.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v11.31.0
2 findingsMaintainer email '[email protected]' uses domain 'rodri360.com' which has no DNS records. An attacker could register this domain to hijack the maintainer identity.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v11.30.0
2 findingsMaintainer email '[email protected]' uses domain 'rodri360.com' which has no DNS records. An attacker could register this domain to hijack the maintainer identity.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v11.29.0
2 findingsMaintainer email '[email protected]' uses domain 'rodri360.com' which has no DNS records. An attacker could register this domain to hijack the maintainer identity.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v11.28.0
2 findingsMaintainer email '[email protected]' uses domain 'rodri360.com' which has no DNS records. An attacker could register this domain to hijack the maintainer identity.
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v11.27.0
2 findingsMaintainer email '[email protected]' uses domain 'rodri360.com' which has no DNS records. An attacker could register this domain to hijack the maintainer identity.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v11.24.0
2 findingsMaintainer email '[email protected]' uses domain 'rodri360.com' which has no DNS records. An attacker could register this domain to hijack the maintainer identity.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v11.23.0
2 findingsMaintainer email '[email protected]' uses domain 'rodri360.com' which has no DNS records. An attacker could register this domain to hijack the maintainer identity.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v11.22.0
2 findingsMaintainer email '[email protected]' uses domain 'rodri360.com' which has no DNS records. An attacker could register this domain to hijack the maintainer identity.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v11.21.0
2 findingsMaintainer email '[email protected]' uses domain 'rodri360.com' which has no DNS records. An attacker could register this domain to hijack the maintainer identity.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v11.20.0
2 findingsMaintainer email '[email protected]' uses domain 'rodri360.com' which has no DNS records. An attacker could register this domain to hijack the maintainer identity.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v11.19.0
2 findingsMaintainer email '[email protected]' uses domain 'rodri360.com' which has no DNS records. An attacker could register this domain to hijack the maintainer identity.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v11.18.0
2 findingsMaintainer email '[email protected]' uses domain 'rodri360.com' which has no DNS records. An attacker could register this domain to hijack the maintainer identity.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v11.17.0
2 findingsMaintainer email '[email protected]' uses domain 'rodri360.com' which has no DNS records. An attacker could register this domain to hijack the maintainer identity.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v11.16.0
2 findingsMaintainer email '[email protected]' uses domain 'rodri360.com' which has no DNS records. An attacker could register this domain to hijack the maintainer identity.
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v11.15.0
2 findingsMaintainer email '[email protected]' uses domain 'rodri360.com' which has no DNS records. An attacker could register this domain to hijack the maintainer identity.
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v11.14.0
2 findingsMaintainer email '[email protected]' uses domain 'rodri360.com' which has no DNS records. An attacker could register this domain to hijack the maintainer identity.
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v11.13.0
2 findingsMaintainer email '[email protected]' uses domain 'rodri360.com' which has no DNS records. An attacker could register this domain to hijack the maintainer identity.
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v11.12.0
2 findingsMaintainer email '[email protected]' uses domain 'rodri360.com' which has no DNS records. An attacker could register this domain to hijack the maintainer identity.
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v11.11.0
2 findingsMaintainer email '[email protected]' uses domain 'rodri360.com' which has no DNS records. An attacker could register this domain to hijack the maintainer identity.
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v11.10.0
2 findingsMaintainer email '[email protected]' uses domain 'rodri360.com' which has no DNS records. An attacker could register this domain to hijack the maintainer identity.
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v11.9.0
2 findingsMaintainer email '[email protected]' uses domain 'rodri360.com' which has no DNS records. An attacker could register this domain to hijack the maintainer identity.
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v11.8.0
2 findingsMaintainer email '[email protected]' uses domain 'rodri360.com' which has no DNS records. An attacker could register this domain to hijack the maintainer identity.
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v11.7.1
2 findingsMaintainer email '[email protected]' uses domain 'rodri360.com' which has no DNS records. An attacker could register this domain to hijack the maintainer identity.
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v11.7.0
2 findingsMaintainer email '[email protected]' uses domain 'rodri360.com' which has no DNS records. An attacker could register this domain to hijack the maintainer identity.
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v11.6.0
2 findingsMaintainer email '[email protected]' uses domain 'rodri360.com' which has no DNS records. An attacker could register this domain to hijack the maintainer identity.
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v11.5.0
2 findingsMaintainer email '[email protected]' uses domain 'rodri360.com' which has no DNS records. An attacker could register this domain to hijack the maintainer identity.
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v11.4.0
2 findingsMaintainer email '[email protected]' uses domain 'rodri360.com' which has no DNS records. An attacker could register this domain to hijack the maintainer identity.
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v11.3.0
2 findingsMaintainer email '[email protected]' uses domain 'rodri360.com' which has no DNS records. An attacker could register this domain to hijack the maintainer identity.
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v11.2.0
2 findingsMaintainer email '[email protected]' uses domain 'rodri360.com' which has no DNS records. An attacker could register this domain to hijack the maintainer identity.
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v11.1.0
2 findingsMaintainer email '[email protected]' uses domain 'rodri360.com' which has no DNS records. An attacker could register this domain to hijack the maintainer identity.
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v11.0.0
2 findingsMaintainer email '[email protected]' uses domain 'rodri360.com' which has no DNS records. An attacker could register this domain to hijack the maintainer identity.
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.