@sinonjs/samsam
Value identification and comparison functions
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| publish-pattern | new-deps-added | AI (publish-pattern): lodash.get, type-detect, and @sinonjs/commons are all established, widely-trusted packages appropriate for a value comparison library. | ai | |
| maintainer-change | maintainer-removed | AI (maintainer-change): peer5 removal is part of the same documented sinonjs org maintainer transition; no evidence of malicious takeover. | ai | |
| source-diff | large-new-source-files | AI (source-diff): v7.0.0 is a major version with significant restructuring and TypeScript type generation; 43 new files is consistent with a legitimate refactor. | ai | |
| maintainer-change | maintainer-added | AI (maintainer-change): benjamin.gruenbaum and simenb are well-known JS testing community contributors; this is a documented sinonjs org transition, not a takeover. | ai | |
| phantom-deps | phantom-dep:@sinonjs/formatio | AI (phantom-deps): @sinonjs/formatio is from the same org scope and its indirect use pattern is expected in the Sinon.js ecosystem. | ai | |
| provenance | publisher-changed | AI (provenance): Publisher change from mantoni to mrgnrdrck in 2020 is a documented Sinon.js org maintainer transition; mrgnrdrck has strong track record (63 approved, 0 rejected). Stable for this package. | ai | |
| dependencies | unvetted-dep:@sinonjs/commons | AI (dependencies): @sinonjs/commons is a core sinonjs ecosystem package and a stable, legitimate dependency of samsam across many versions. Not a real risk. | ai | |
| provenance | no-provenance | AI (provenance): Established sinonjs ecosystem package; lack of provenance is common and not a meaningful risk signal here. | ai |
Versions (showing 48 of 48)
| Version | Deps | Published |
|---|---|---|
| 10.0.2 | 2 / 23 | |
| 10.0.1 | 2 / 22 | |
| 10.0.0 | 2 / 22 | |
| 9.0.3 | 2 / 22 | |
| 9.0.2 | 2 / 22 | |
| 9.0.1 | 2 / 22 | |
| 9.0.0 | 2 / 22 | |
| 8.0.3 | 2 / 20 | |
| 8.0.2 | 3 / 20 | |
| 8.0.1 | 3 / 20 | |
| 8.0.0 | 3 / 20 | |
| 7.0.1 | 3 / 20 | |
| 7.0.0 | 3 / 20 | |
| 6.1.3 | 3 / 20 | |
| 6.1.2 | 3 / 20 | |
| 6.1.1 | 3 / 21 | |
| 6.1.0 | 3 / 21 | |
| 6.0.2 | 3 / 21 | |
| 6.0.1 | 3 / 21 | |
| 6.0.0 | 3 / 21 | |
| 5.3.1 | 3 / 27 | |
| 5.3.0 | 3 / 30 | |
| 5.2.0 | 3 / 29 | |
| 5.1.0 | 3 / 29 | |
| 5.0.3 | 3 / 29 | |
| 5.0.2 | 4 / 29 | |
| 5.0.1 | 3 / 29 | |
| 5.0.0 | 3 / 29 | |
| 4.2.2 | 3 / 29 | |
| 4.2.1 | 3 / 29 | |
| 4.2.0 | 3 / 27 | |
| 4.1.0 | 3 / 27 | |
| 4.0.1 | 3 / 27 | |
| 3.3.3 | 3 / 21 | |
| 3.3.2 | 3 / 21 | |
| 3.3.1 | 3 / 21 | |
| 3.3.0 | 3 / 21 | |
| 3.2.0 | 3 / 21 | |
| 3.1.1 | 3 / 21 | |
| 3.1.0 | 3 / 21 | |
| 3.0.2 | 3 / 21 | |
| 3.0.1 | 3 / 21 | |
| 3.0.0 | 3 / 21 | |
| 2.1.3 | 0 / 21 | |
| 2.1.2 | 0 / 21 | |
| 2.1.1 | 1 / 20 | |
| 2.1.0 | 1 / 20 | |
| 2.0.0 | 0 / 15 |
v10.0.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v10.0.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v10.0.0
2 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2026-03-20. This could indicate a legitimate maintainer transition or an account compromise.
v9.0.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.0.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.0.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.0.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v8.0.1
2 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2024-09-12. This could indicate a legitimate maintainer transition or an account compromise.
v8.0.0
2 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2023-03-26. This could indicate a legitimate maintainer transition or an account compromise.
v7.0.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v7.0.0
2 findingsThis version was published by a different npm account than previous versions on 2022-11-02. This could indicate a legitimate maintainer transition or an account compromise.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v6.1.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v6.1.2
2 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2022-10-31. This could indicate a legitimate maintainer transition or an account compromise.
v6.1.1
2 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2022-01-28. This could indicate a legitimate maintainer transition or an account compromise.
v6.1.0
2 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2022-01-27. This could indicate a legitimate maintainer transition or an account compromise.
v6.0.2
2 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2021-05-24. This could indicate a legitimate maintainer transition or an account compromise.
v6.0.1
2 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2021-04-08. This could indicate a legitimate maintainer transition or an account compromise.
v6.0.0
2 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2021-03-30. This could indicate a legitimate maintainer transition or an account compromise.
v5.3.1
2 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2021-01-13. This could indicate a legitimate maintainer transition or an account compromise.
v5.3.0
2 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2020-11-16. This could indicate a legitimate maintainer transition or an account compromise.
v5.2.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.1.0
2 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2020-08-11. This could indicate a legitimate maintainer transition or an account compromise.
v5.0.3
2 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2020-02-28. This could indicate a legitimate maintainer transition or an account compromise.
v5.0.2
2 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2020-02-20. This could indicate a legitimate maintainer transition or an account compromise.
v5.0.1
2 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2020-02-18. This could indicate a legitimate maintainer transition or an account compromise.
v5.0.0
2 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2020-02-18. This could indicate a legitimate maintainer transition or an account compromise.
v4.2.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.2.1
2 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2019-12-30. This could indicate a legitimate maintainer transition or an account compromise.
v4.2.0
2 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2019-10-12. This could indicate a legitimate maintainer transition or an account compromise.
v4.1.0
2 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2019-10-12. This could indicate a legitimate maintainer transition or an account compromise.
v4.0.1
2 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2019-10-11. This could indicate a legitimate maintainer transition or an account compromise.
v3.3.3
2 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2019-08-19. This could indicate a legitimate maintainer transition or an account compromise.
v3.3.2
2 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2019-06-17. This could indicate a legitimate maintainer transition or an account compromise.
v3.3.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.3.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.2.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.1.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v3.1.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.0.2
2 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2018-12-10. This could indicate a legitimate maintainer transition or an account compromise.
v3.0.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.0.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.1.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v2.1.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v2.1.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v2.1.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v2.0.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.