@graphql-yoga/typed-event-target
This is an internal package. Please don't use this package directly. The package will do unexpected breaking changes.
Supply chain provenance
Status for the latest visible version.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| provenance | missing-githead | AI (provenance): Package has SLSA provenance attestation via Sigstore, which supersedes gitHead as a supply chain integrity signal. Missing gitHead is a pipeline change, not a security concern for this well-established package. | ai | |
| phantom-deps | phantom-dep:tslib | AI (phantom-deps): tslib is a standard TypeScript runtime helper dependency; its indirect import pattern is expected in compiled TypeScript packages. | ai | |
| phantom-deps | phantom-dep:@repeaterjs/repeater | AI (phantom-deps): Referenced in config files as documented; legitimate dependency for this event-target/pubsub utility package. | ai | |
| bogus-package | bogus-package | AI (bogus-package): Short README and empty CJS entry are consistent with a TypeScript-first monorepo scoped package. Not indicative of spam or malicious intent for this established graphql-yoga package. | ai |
Versions (showing 8 of 8)
| Version | Deps | Published |
|---|---|---|
| 3.0.2 | 2 / 0 | |
| 3.0.1 | 2 / 0 | |
| 3.0.0 | 2 / 0 | |
| 2.0.0 | 2 / 0 | |
| 1.0.0 | 2 / 0 | |
| 0.1.1 | 2 / 0 | |
| 0.1.0 | 2 / 0 | |
| 0.0.0 | 2 / 0 |
v3.0.2
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: dotansimha.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v3.0.1
2 findingsPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
[Accepted risk] This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: dotansimha.
v3.0.0
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: dotansimha.
v2.0.0
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: dotansimha.