@sentry/hub
Sentry hub which handles global state managment.
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| typosquat | typosquat.levenshtein:yup | AI (typosquat): @sentry/hub is a legitimate, long-established Sentry SDK package. The Levenshtein match against 'yup' is a false positive — scoped @sentry/* packages are not typosquats of unrelated short package names. | ai | |
| provenance | no-provenance | AI (provenance): Sentry publishes via sentry-bot with a 3,896-package approved track record. Lack of Sigstore provenance is expected for this publisher and package age. | ai |
Versions (showing 100 of 343)
| Version | Deps | Published |
|---|---|---|
| 6.13.3 | 3 / 6 | |
| 6.13.2 | 3 / 6 | |
| 6.13.1 | 3 / 6 | |
| 6.13.0 | 3 / 6 | |
| 6.12.0 | 3 / 6 | |
| 6.11.0 | 3 / 6 | |
| 6.10.0 | 3 / 6 | |
| 6.9.0 | 3 / 6 | |
| 6.8.0 | 3 / 6 | |
| 6.7.2 | 3 / 6 | |
| 6.7.1 | 3 / 6 | |
| 6.7.0 | 3 / 6 | |
| 6.6.0 | 3 / 6 | |
| 6.5.1 | 3 / 6 | |
| 6.5.0 | 3 / 7 | |
| 6.4.1 | 3 / 7 | |
| 6.4.0 | 3 / 7 | |
| 6.3.6 | 3 / 7 | |
| 6.3.5 | 3 / 7 | |
| 6.3.4 | 3 / 7 | |
| 6.3.3 | 3 / 7 | |
| 6.3.2 | 3 / 7 | |
| 6.3.1 | 3 / 7 | |
| 6.3.0 | 3 / 7 | |
| 6.2.5 | 3 / 7 | |
| 6.2.4 | 3 / 7 | |
| 6.2.3 | 3 / 7 | |
| 6.2.2 | 3 / 7 | |
| 6.2.1 | 3 / 7 | |
| 6.2.0 | 3 / 7 | |
| 6.1.0 | 3 / 7 | |
| 6.0.4 | 3 / 7 | |
| 6.0.3 | 3 / 7 | |
| 6.0.2 | 3 / 7 | |
| 6.0.1 | 3 / 7 | |
| 6.0.0 | 3 / 7 | |
| 5.30.0 | 3 / 7 | |
| 5.29.2 | 3 / 7 | |
| 5.29.1 | 3 / 7 | |
| 5.29.0 | 3 / 7 | |
| 5.28.0 | 3 / 7 | |
| 5.27.6 | 3 / 7 | |
| 5.27.5 | 3 / 7 | |
| 5.27.4 | 3 / 7 | |
| 5.27.3 | 3 / 7 | |
| 5.27.2 | 3 / 7 | |
| 5.27.1 | 3 / 7 | |
| 5.27.0 | 3 / 7 | |
| 5.26.0 | 3 / 7 | |
| 5.25.0 | 3 / 7 | |
| 5.24.2 | 3 / 7 | |
| 5.24.1 | 3 / 7 | |
| 5.24.0 | 3 / 7 | |
| 5.23.0 | 3 / 7 | |
| 5.22.3 | 3 / 7 | |
| 5.22.2 | 3 / 7 | |
| 5.22.1 | 3 / 7 | |
| 5.22.0 | 3 / 7 | |
| 5.21.4 | 3 / 7 | |
| 5.21.3 | 3 / 7 | |
| 5.21.2 | 3 / 7 | |
| 5.21.1 | 3 / 7 | |
| 5.21.0 | 3 / 7 | |
| 5.20.1 | 3 / 7 | |
| 5.20.0 | 3 / 7 | |
| 5.19.2 | 3 / 7 | |
| 5.19.1 | 3 / 7 | |
| 5.19.0 | 3 / 7 | |
| 5.18.1 | 3 / 7 | |
| 5.18.0 | 3 / 7 | |
| 5.17.0 | 3 / 7 | |
| 5.16.1 | 3 / 7 | |
| 5.16.0 | 3 / 7 | |
| 5.15.5 | 3 / 7 | |
| 5.15.4 | 3 / 7 | |
| 5.15.3 | 3 / 7 | |
| 5.15.2 | 3 / 7 | |
| 5.15.1 | 3 / 7 | |
| 5.15.0 | 3 / 7 | |
| 5.14.2 | 3 / 7 | |
| 5.14.1 | 3 / 7 | |
| 5.14.0 | 3 / 7 | |
| 5.13.2 | 3 / 7 | |
| 5.13.0 | 3 / 7 | |
| 5.12.5 | 3 / 7 | |
| 5.12.4 | 3 / 7 | |
| 5.12.0 | 3 / 7 | |
| 5.11.2 | 3 / 7 | |
| 5.11.1 | 3 / 7 | |
| 5.11.0 | 3 / 7 | |
| 5.10.2 | 3 / 7 | |
| 5.10.1 | 3 / 7 | |
| 5.10.0 | 3 / 7 | |
| 5.8.0 | 3 / 7 | |
| 5.7.1 | 3 / 7 | |
| 5.7.0 | 3 / 7 | |
| 5.6.1 | 3 / 7 | |
| 5.6.0 | 3 / 7 | |
| 5.5.0 | 3 / 7 | |
| 5.4.3 | 3 / 7 |
v6.13.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.13.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.13.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.13.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.12.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.11.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.10.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.9.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.8.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.7.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.7.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.7.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.6.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.5.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.5.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.4.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.4.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.3.6
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.3.5
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.3.4
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.3.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.3.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.3.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.3.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.2.5
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.2.4
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.2.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.2.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.2.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.2.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.1.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.0.4
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.0.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.0.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.0.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.0.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.