configstore
Easily load and save config without having to think about where and how
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| license | uncommon-license:BSD | AI (license): BSD is a well-known permissive open-source license; the 'uncommon' flag is a false positive for this package and will remain so across all versions. | ai | |
| publish-pattern | dormant-publish | AI (publish-pattern): sindresorhus maintains hundreds of packages; extended gaps between releases are normal for this publisher and not indicative of account takeover. | ai | |
| publish-pattern | new-deps-added | AI (publish-pattern): atomically is a sindresorhus-authored package replacing write-file-atomic; the swap is semantically coherent and consistent with the publisher's ecosystem patterns. | ai | |
| dependencies | unvetted-dep:atomically | AI (dependencies): atomically is a well-known sindresorhus-ecosystem package for atomic file writes — a natural and expected dependency for a config persistence library. | ai | |
| dependencies | unvetted-dep:dot-prop | AI (dependencies): dot-prop is a sindresorhus package with a long history, used for dot-notation property access — core to configstore's functionality. Stable false positive for this package. | ai | |
| maintainer-change | maintainer-removed | AI (maintainer-change): sindresorhus consolidating ownership of his own packages is a known pattern; removal of legacy co-maintainers without adding unknown new ones is not a takeover signal. | ai | |
| provenance | no-provenance | AI (provenance): Already marked accepted risk in findings; sindresorhus publishes many packages without Sigstore provenance — stable false positive for this publisher. | ai |
Versions (showing 29 of 29)
| Version | Deps | Published |
|---|---|---|
| 8.0.0 | 5 / 2 | |
| 6.0.0 | 5 / 2 | |
| 5.0.1 | 6 / 2 | |
| 5.0.0 | 6 / 2 | |
| 4.0.0 | 6 / 2 | |
| 3.1.2 | 6 / 2 | |
| 3.1.1 | 6 / 2 | |
| 3.1.0 | 6 / 2 | |
| 3.0.0 | 6 / 2 | |
| 2.0.0 | 9 / 3 | |
| 1.4.0 | 8 / 3 | |
| 1.3.0 | 8 / 3 | |
| 1.2.1 | 8 / 2 | |
| 1.2.0 | 8 / 2 | |
| 1.1.0 | 8 / 2 | |
| 1.0.0 | 7 / 1 | |
| 0.3.1 | 6 / 1 | |
| 0.3.0 | 6 / 1 | |
| 0.2.2 | 6 / 1 | |
| 0.2.1 | 6 / 1 | |
| 0.2.0 | 6 / 1 | |
| 0.1.7 | 5 / 1 | |
| 0.1.6 | 5 / 1 | |
| 0.1.5 | 4 / 1 | |
| 0.1.4 | 4 / 1 | |
| 0.1.3 | 3 / 1 | |
| 0.1.2 | 3 / 1 | |
| 0.1.1 | 3 / 1 | |
| 0.1.0 | 3 / 1 |
v6.0.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.0.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.0.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.0.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v3.1.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.1.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.1.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.0.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.0.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.4.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.3.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.2.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.2.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.1.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.3.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.3.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.2.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.2.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.2.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.1.7
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.1.6
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.1.5
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.1.4
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.1.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.1.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.1.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.1.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.