@tscircuit/capacity-autorouter
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| npm-metadata | url-dep:dataset-srj18 | AI (npm-metadata): devDependency only; tscircuit org repo matching publisher identity; same pattern as other accepted URL deps in this package. | ai | |
| npm-metadata | url-dep:@tscircuit/autorouting-dataset-01 | AI (npm-metadata): devDependency only; tscircuit org repo matching publisher identity; same pattern as other accepted URL deps in this package. | ai | |
| npm-metadata | url-dep:@tsci/tscircuit.dataset-srj16-bga-breakouts | AI (npm-metadata): devDependency SHA-pinned to tscircuit org's own repo; same pattern as all other accepted url-deps in this package. | ai | |
| npm-metadata | url-dep:high-density-repair01 | AI (npm-metadata): devDependency test fixture from tscircuit org; not shipped to consumers. | ai | |
| npm-metadata | url-dep:high-density-repair03 | AI (npm-metadata): devDependency test fixture from tscircuit org; not shipped to consumers. | ai | |
| npm-metadata | url-dep:dataset-srj11-45-degree | AI (npm-metadata): devDependency test dataset from tscircuit org; not shipped to consumers. | ai | |
| npm-metadata | url-dep:@tscircuit/dataset-srj05 | AI (npm-metadata): devDependency test dataset from tscircuit org; not shipped to consumers. | ai | |
| npm-metadata | url-dep:high-density-dataset-z04 | AI (npm-metadata): devDependency test dataset from tscircuit org; not shipped to consumers. | ai | |
| npm-metadata | url-dep:@tsci/tscircuit.dataset-srj12-bus-routing | AI (npm-metadata): devDependency test dataset from tscircuit org; not shipped to consumers. | ai | |
| npm-metadata | url-dep:@tscircuit/rectdiff | AI (npm-metadata): devDependency from tscircuit org; not shipped to consumers. | ai | |
| npm-metadata | url-dep:pcb-poly-hyper-graph | AI (npm-metadata): devDependency from tscircuit org; not shipped to consumers. | ai | |
| npm-metadata | url-dep:tiny-hypergraph-poly | AI (npm-metadata): devDependency from tscircuit org; not shipped to consumers. | ai | |
| npm-metadata | url-dep:high-density-repair02 | AI (npm-metadata): devDependency from tscircuit org; not shipped to consumers. | ai | |
| npm-metadata | url-dep:@tscircuit/fixed-via-hypergraph-solver | AI (npm-metadata): devDependency from tscircuit org; not shipped to consumers. | ai | |
| npm-metadata | url-dep:@tsci/seveibar.dataset-srj13 | AI (npm-metadata): devDependency test dataset from tscircuit org; not shipped to consumers. | ai | |
| npm-metadata | url-dep:zdwiel-dataset | AI (npm-metadata): devDependency benchmark dataset pinned by SHA; not shipped to consumers. | ai | |
| npm-metadata | url-dep:tiny-hypergraph | AI (npm-metadata): devDependency test fixture from tscircuit org; not shipped to consumers. | ai | |
| phantom-deps | phantom-dep:bun-match-svg | AI (phantom-deps): Likely used in test/build scripts referenced via config rather than direct import; stable FP. | ai | |
| phantom-deps | phantom-dep:fast-json-stable-stringify | AI (phantom-deps): Listed as a runtime dep in package.json; phantom-dep heuristic false positive for this package. | ai | |
| phantom-deps | phantom-dep:object-hash | AI (phantom-deps): Listed as a runtime dep in package.json; phantom-dep heuristic false positive for this package. | ai |
Versions (showing 9 of 409)
| Version | Deps | Published |
|---|---|---|
| 0.0.64 | 2 / 34 | |
| 0.0.63 | 2 / 34 | |
| 0.0.62 | 2 / 34 | |
| 0.0.61 | 2 / 34 | |
| 0.0.60 | 2 / 34 | |
| 0.0.59 | 2 / 30 | |
| 0.0.58 | 0 / 28 | |
| 0.0.57 | 0 / 28 | |
| 0.0.56 | 0 / 28 |
v0.0.64
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.0.63
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.0.62
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.0.61
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.0.60
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.0.59
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.0.58
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.0.57
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.0.56
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.