changelog — Greenflagged

Command line tool (and Node module) that generates a changelog in color output, markdown, or json for modules in npmjs.org's registry as well as any public github.com repo.

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.

Maintainers

dylangrarkins

Keywords

changelogchange logcommit messagescommitschangeshistorywhat's newchange set

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
provenance	no-provenance	AI (provenance): Package is 5379 days old; provenance attestation was not available at publish time. Trusted publisher with clean track record.	ai	2026/04/24
phantom-deps	phantom-dep:chai	AI (phantom-deps): chai is listed in both dependencies and devDependencies; it's a test library accidentally included in runtime deps, not a security concern for this package.	ai	2026/04/24
publish-pattern	new-deps-added	AI (publish-pattern): github-url-from-git is a well-known, legitimate utility appropriate for a changelog tool that works with GitHub repos. No malicious indicators.	ai	2026/04/24
provenance	publisher-changed	AI (provenance): The dylang→rarkins transition occurred in 2017 and is a well-known legitimate maintainer handoff. rarkins (Rhys Arkins) is a reputable, long-standing npm publisher with 30 approved packages.	ai	2026/04/24
maintainer-change	maintainer-added	AI (maintainer-change): rarkins is a well-established publisher (first seen 3238 days ago, 30 approved packages). The maintainer addition dates to 2017 and represents a legitimate transfer.	ai	2026/04/24
email-domain	unclaimed-email:keylocation.sg	AI (email-domain): Established package with strong publisher track record; unclaimed domain is a hygiene concern but no active exploit or malicious indicators present.	ai	2026/04/24
dependencies	unvetted-dep:request	AI (dependencies): request is a well-known HTTP client library; its presence as a dependency in this established package is expected and not a security concern.	ai	2026/04/23

Versions (showing 13 of 13)

Version	Deps	Published
1.4.1	10 / 13	2017-11-06
1.4.0	10 / 13	2017-07-08
1.3.0	9 / 13	2017-06-12
1.2.1	9 / 12	2017-06-12
1.0.6	8 / 12	2014-10-06
1.0.1	9 / 2	2013-09-20
1.0.0	9 / 2	2013-09-20
0.1.3	6 / 0	2011-11-21
0.1.1	6 / 1	2011-08-24
0.0.8	6 / 1	2011-08-16
0.0.6	6 / 1	2011-08-07
0.0.5	6 / 1	2011-08-05
0.0.4	6 / 1	2011-08-04