← Home

@tscircuit/core

npm Repository Homepage

The core logic used to build Circuit JSON from tscircuit React elements.

100
Versions
—
License
No
Install Scripts
Missing
Provenance

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.

Maintainers

seveibar

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
npm-metadata url-dep:@tscircuit/jlcpcb-manufacturing-specs AI (npm-metadata): SHA-pinned dep is in devDependencies pointing to same org; not included in published dist, stable pattern for this package. ai
phantom-deps phantom-dep:@flatten-js/core AI (phantom-deps): Declared dependency used in config; stable pattern for this package. ai
dependencies unvetted-dep:calculate-cell-boundaries AI (dependencies): Fits tscircuit geometry utility pattern; publisher has strong track record and this is a domain-appropriate dep. ai
dependencies unvetted-dep:react-reconciler-18 AI (dependencies): react-reconciler-18 is a version alias for [email protected], a standard React dual-version support pattern for this package. ai
phantom-deps phantom-dep:nanoid AI (phantom-deps): nanoid is declared and used; phantom-dep rule is a false positive for config-referenced dependencies. ai
phantom-deps phantom-dep:performance-now AI (phantom-deps): performance-now is declared and used; phantom-dep rule is a false positive for config-referenced dependencies. ai
typosquat typosquat.levenshtein:cors AI (typosquat): @tscircuit/core is a scoped package in the tscircuit ecosystem (circuit design framework), not a typosquat of 'cors'. The name similarity is purely coincidental; no brand impersonation. ai
dependencies unvetted-dep:transformation-matrix AI (dependencies): Matrix transformation library; appropriate for 2D coordinate transforms in circuit layout. ai
dependencies unvetted-dep:@lume/kiwi AI (dependencies): Legitimate constraint-solving library appropriate for circuit layout; no security concerns. ai
dependencies unvetted-dep:format-si-unit AI (dependencies): Small utility for SI unit formatting; appropriate for electronics tooling. ai
dependencies unvetted-dep:@flatten-js/core AI (dependencies): Geometry library for 2D operations; appropriate for circuit/PCB layout. ai
dependencies unvetted-dep:calculate-packing AI (dependencies): Packing algorithm library; appropriate for component placement in circuit design. ai
dependencies unvetted-dep:svg-path-commander AI (dependencies): SVG path manipulation library; appropriate for circuit-to-SVG rendering. ai

Versions (showing 100 of 784)

Version Deps Published
0.0.1220 12 / 56
0.0.1219 12 / 56
0.0.1218 12 / 56
0.0.1217 11 / 56
0.0.1216 11 / 56
0.0.1215 11 / 56
0.0.1214 11 / 56
0.0.1213 11 / 56
0.0.1212 11 / 56
0.0.1211 11 / 56
0.0.1210 11 / 56
0.0.1209 11 / 56
0.0.1208 11 / 56
0.0.1207 11 / 56
0.0.1206 11 / 56
0.0.1205 11 / 56
0.0.1204 11 / 56
0.0.1203 11 / 56
0.0.1202 11 / 56
0.0.1201 11 / 56
0.0.1200 11 / 56
0.0.1199 11 / 56
0.0.1198 11 / 56
0.0.1197 11 / 56
0.0.1196 11 / 56
0.0.1195 11 / 56
0.0.1194 11 / 56
0.0.1193 11 / 56
0.0.1192 11 / 56
0.0.1191 11 / 56
0.0.1190 11 / 56
0.0.1189 11 / 56
0.0.1188 11 / 56
0.0.1187 11 / 56
0.0.1186 11 / 56
0.0.1185 11 / 56
0.0.1184 11 / 56
0.0.1183 11 / 56
0.0.1182 11 / 56
0.0.1181 11 / 56
0.0.1180 11 / 56
0.0.1179 11 / 56
0.0.1178 11 / 56
0.0.1177 11 / 56
0.0.1176 11 / 55
0.0.1175 11 / 55
0.0.1174 11 / 55
0.0.1173 11 / 55
0.0.1172 11 / 55
0.0.1171 11 / 55
0.0.1170 11 / 55
0.0.1169 11 / 55
0.0.1168 11 / 55
0.0.1167 11 / 55
0.0.1166 11 / 55
0.0.1165 11 / 55
0.0.1164 11 / 55
0.0.1163 11 / 55
0.0.1162 11 / 55
0.0.1161 11 / 55
0.0.1160 11 / 55
0.0.1159 11 / 55
0.0.1158 11 / 55
0.0.1157 11 / 55
0.0.1156 11 / 55
0.0.1155 11 / 55
0.0.1154 11 / 55
0.0.1153 11 / 55
0.0.1152 11 / 55
0.0.1151 11 / 55
0.0.1150 11 / 55
0.0.1149 11 / 55
0.0.1148 11 / 55
0.0.1147 11 / 55
0.0.1146 11 / 55
0.0.1145 11 / 55
0.0.1144 11 / 55
0.0.1143 11 / 55
0.0.1142 11 / 55
0.0.1141 11 / 55
0.0.1140 11 / 55
0.0.1139 11 / 55
0.0.1138 11 / 55
0.0.1137 11 / 55
0.0.1136 11 / 55
0.0.1135 11 / 55
0.0.1134 11 / 55
0.0.1133 11 / 55
0.0.1132 11 / 55
0.0.1131 11 / 55
0.0.1130 11 / 55
0.0.1129 11 / 55
0.0.1128 11 / 55
0.0.1127 11 / 55
0.0.1126 11 / 55
0.0.1125 11 / 55
0.0.1124 11 / 55
0.0.1123 11 / 55
0.0.1122 11 / 55
0.0.1121 11 / 55
Showing 100 of 784 Next page →

v0.0.1220

2 findings
HIGH SHA-pinned github dependency (devDependencies): @tscircuit/jlcpcb-manufacturing-specs npm-metadata

Dependency '@tscircuit/jlcpcb-manufacturing-specs' in `devDependencies` points to 'git+https://github.com/tscircuit/jlcpcb-manufacturing-specs.git#e08af159db01a37db007e33f0a7268d0e4a279a5' instead of a registry version. URL dependencies bypass the registry and can be swapped at any time. A 40-character commit SHA in a dependency URL is a strong supply-chain signal — the 2026-05-11 TanStack/Mini Shai-Hulud attack used this exact shape in `optionalDependencies` to smuggle a malicious payload past lifecycle-script and OSV checks.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.1219

2 findings
HIGH SHA-pinned github dependency (devDependencies): @tscircuit/jlcpcb-manufacturing-specs npm-metadata

Dependency '@tscircuit/jlcpcb-manufacturing-specs' in `devDependencies` points to 'git+https://github.com/tscircuit/jlcpcb-manufacturing-specs.git#e08af159db01a37db007e33f0a7268d0e4a279a5' instead of a registry version. URL dependencies bypass the registry and can be swapped at any time. A 40-character commit SHA in a dependency URL is a strong supply-chain signal — the 2026-05-11 TanStack/Mini Shai-Hulud attack used this exact shape in `optionalDependencies` to smuggle a malicious payload past lifecycle-script and OSV checks.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.1218

2 findings
HIGH SHA-pinned github dependency (devDependencies): @tscircuit/jlcpcb-manufacturing-specs npm-metadata

Dependency '@tscircuit/jlcpcb-manufacturing-specs' in `devDependencies` points to 'git+https://github.com/tscircuit/jlcpcb-manufacturing-specs.git#e08af159db01a37db007e33f0a7268d0e4a279a5' instead of a registry version. URL dependencies bypass the registry and can be swapped at any time. A 40-character commit SHA in a dependency URL is a strong supply-chain signal — the 2026-05-11 TanStack/Mini Shai-Hulud attack used this exact shape in `optionalDependencies` to smuggle a malicious payload past lifecycle-script and OSV checks.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.1217

2 findings
HIGH SHA-pinned github dependency (devDependencies): @tscircuit/jlcpcb-manufacturing-specs npm-metadata

Dependency '@tscircuit/jlcpcb-manufacturing-specs' in `devDependencies` points to 'git+https://github.com/tscircuit/jlcpcb-manufacturing-specs.git#e08af159db01a37db007e33f0a7268d0e4a279a5' instead of a registry version. URL dependencies bypass the registry and can be swapped at any time. A 40-character commit SHA in a dependency URL is a strong supply-chain signal — the 2026-05-11 TanStack/Mini Shai-Hulud attack used this exact shape in `optionalDependencies` to smuggle a malicious payload past lifecycle-script and OSV checks.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.1216

2 findings
HIGH SHA-pinned github dependency (devDependencies): @tscircuit/jlcpcb-manufacturing-specs npm-metadata

Dependency '@tscircuit/jlcpcb-manufacturing-specs' in `devDependencies` points to 'git+https://github.com/tscircuit/jlcpcb-manufacturing-specs.git#e08af159db01a37db007e33f0a7268d0e4a279a5' instead of a registry version. URL dependencies bypass the registry and can be swapped at any time. A 40-character commit SHA in a dependency URL is a strong supply-chain signal — the 2026-05-11 TanStack/Mini Shai-Hulud attack used this exact shape in `optionalDependencies` to smuggle a malicious payload past lifecycle-script and OSV checks.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.1215

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.1214

2 findings
HIGH SHA-pinned github dependency (devDependencies): @tscircuit/jlcpcb-manufacturing-specs npm-metadata

Dependency '@tscircuit/jlcpcb-manufacturing-specs' in `devDependencies` points to 'git+https://github.com/tscircuit/jlcpcb-manufacturing-specs.git#e08af159db01a37db007e33f0a7268d0e4a279a5' instead of a registry version. URL dependencies bypass the registry and can be swapped at any time. A 40-character commit SHA in a dependency URL is a strong supply-chain signal — the 2026-05-11 TanStack/Mini Shai-Hulud attack used this exact shape in `optionalDependencies` to smuggle a malicious payload past lifecycle-script and OSV checks.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.1213

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.1212

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.1211

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.1210

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.1209

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.1208

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.1204

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.1203

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.1202

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.1201

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.1199

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.1198

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.1197

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.1196

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.1195

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.1194

2 findings
HIGH typosquat.levenshtein: Possible typosquat of 'cors' typosquat

Package name '@tscircuit/core' is 1 edit(s) away from popular package 'cors'.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.0.1193

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.0.1192

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.0.1191

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.0.1190

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.0.1189

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.0.1188

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.0.1187

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.0.1186

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.0.1185

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.0.1184

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.0.1183

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.0.1182

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.0.1181

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.0.1180

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.0.1179

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.0.1178

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.0.1177

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.0.1176

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.0.1175

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.0.1174

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.0.1173

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.0.1172

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.0.1171

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.0.1170

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.0.1169

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.0.1168

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.0.1167

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.0.1166

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.0.1165

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.0.1164

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.0.1163

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.0.1162

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.0.1161

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.0.1160

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.0.1159

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.0.1158

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.0.1157

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.0.1156

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.0.1155

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.0.1154

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.0.1153

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.0.1152

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.0.1151

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.0.1150

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.1149

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.0.1148

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.0.1147

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.0.1146

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.0.1145

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.0.1144

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.0.1143

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.0.1142

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.0.1141

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.0.1140

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.0.1139

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.0.1138

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.0.1137

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.0.1136

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.0.1135

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.0.1134

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.0.1133

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.0.1132

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.0.1131

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.0.1130

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.0.1129

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.0.1128

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.0.1127

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.0.1126

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.0.1125

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.0.1124

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.0.1123

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.1122

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.1121

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.