@transportial/ors LicenseRef-PolyForm-Shield-1.0.0 2 versions

@transportial/ors

npm Repository Homepage

BDI Orkestratie Register (ORS) - chain contexts, involvement, BVOD issuance.

Versions

LicenseRef-PolyForm-Shield-1.0.0

License

Install Scripts

Verified

Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures gitHead linked

developers-transportial

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
typosquat	typosquat.levenshtein:cors	AI (typosquat): @transportial/ors is a scoped BDI orchestration package, not a typosquat of cors.	ai	2026/05/15
typosquat	typosquat.levenshtein:qs	AI (typosquat): @transportial/ors is a scoped BDI orchestration package, not a typosquat of qs.	ai	2026/05/15
phantom-deps	phantom-dep:@transportial/config	AI (phantom-deps): Same-org scoped dep; likely used indirectly via @transportial/kernel or similar internal wiring.	ai	2026/05/15
phantom-deps	phantom-dep:@transportial/events	AI (phantom-deps): Same-org scoped dep; likely used indirectly within the @transportial ecosystem.	ai	2026/05/15

Version	Deps	Published
0.1.4	6 / 2	2026-05-05
0.1.0	6 / 2	2026-04-29

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

2 findings

HIGH typosquat.levenshtein: Possible typosquat of 'cors' typosquat

Package name '@transportial/ors' is 1 edit(s) away from popular package 'cors'.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.