gatsby-telemetry
Gatsby Telemetry
57
Versions
MIT
License
Yes
Install Scripts
Missing
Provenance
Supply chain provenance
Status for the latest visible version.
No SLSA provenance
npm registry signatures
gitHead linked
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
mlgualtieri-gatsbyserhalp-netlifykathmbeckpiehtylerbarnesdaniellewgatsbyfk
Keywords
telemetry
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| phantom-deps | phantom-dep:async-retry-ng | AI (phantom-deps): async-retry-ng is a declared runtime dep in the official Gatsby telemetry package; phantom-dep flag is a false positive for this package's usage pattern. | ai | |
| dependencies | unvetted-dep:async-retry-ng | AI (dependencies): async-retry-ng is a declared dependency of gatsby-telemetry in the official Gatsby monorepo; its use is consistent with the package's retry logic for telemetry HTTP calls. | ai | |
| provenance | no-provenance | AI (provenance): gatsby-telemetry is a well-established Gatsby monorepo package; lack of Sigstore provenance is a process gap, not a security risk for this package. | ai | |
| phantom-deps | phantom-dep:node-fetch | AI (phantom-deps): node-fetch is a declared runtime dependency in package.json; phantom-dep false positive for compiled TypeScript packages where imports appear in lib/ output. | ai | |
| phantom-deps | phantom-dep:@babel/code-frame | AI (phantom-deps): @babel/code-frame is a declared runtime dependency; framework-scoped usage is expected in Gatsby packages. Stable false positive. | ai | |
| install-scripts | install-script:postinstall | AI (install-scripts): gatsby-telemetry's postinstall (node src/postinstall.js || true) is a long-standing telemetry opt-out notification script, stable across hundreds of versions. Not a risk. | ai | |
| provenance | publisher-changed | AI (provenance): Publisher change from pieh to serhalp-netlify reflects Netlify's acquisition of Gatsby; serhalp-netlify is a verified Netlify-affiliated account with strong track record (5550 approved, 0 rejected). | ai | |
| maintainer-change | maintainer-added | AI (maintainer-change): New maintainers mlgualtieri-gatsby and serhalp-netlify are Netlify/Gatsby org accounts consistent with the documented Netlify acquisition of Gatsby. | ai | |
| semgrep | semgrep:child-process-import | AI (semgrep): child_process is used in repository-id.js to run git commands for telemetry repo identification — expected and stable behavior for this package. | ai | |
| maintainer-change | maintainer-removed | AI (maintainer-change): Removal of legacy Gatsby maintainers is consistent with the Netlify acquisition transition; not indicative of a malicious takeover. | ai |
Versions (showing 57 of 157)
| Version | Deps | Published |
|---|---|---|
| 1.1.46 | 17 / 8 | |
| 1.1.45 | 17 / 8 | |
| 1.1.44 | 17 / 8 | |
| 1.1.42 | 17 / 8 | |
| 1.1.41 | 17 / 8 | |
| 1.1.40 | 17 / 8 | |
| 1.1.39 | 17 / 8 | |
| 1.1.38 | 17 / 8 | |
| 1.1.37 | 17 / 8 | |
| 1.1.36 | 17 / 8 | |
| 1.1.35 | 17 / 8 | |
| 1.1.34 | 17 / 8 | |
| 1.1.33 | 17 / 8 | |
| 1.1.32 | 17 / 8 | |
| 1.1.31 | 17 / 8 | |
| 1.1.30 | 17 / 8 | |
| 1.1.29 | 17 / 8 | |
| 1.1.28 | 17 / 8 | |
| 1.1.26 | 17 / 8 | |
| 1.1.25 | 17 / 8 | |
| 1.1.24 | 17 / 8 | |
| 1.1.23 | 17 / 8 | |
| 1.1.22 | 17 / 8 | |
| 1.1.21 | 17 / 8 | |
| 1.1.20 | 17 / 8 | |
| 1.1.19 | 17 / 8 | |
| 1.1.18 | 17 / 8 | |
| 1.1.17 | 17 / 8 | |
| 1.1.16 | 17 / 8 | |
| 1.1.15 | 17 / 8 | |
| 1.1.14 | 17 / 8 | |
| 1.1.13 | 17 / 8 | |
| 1.1.12 | 17 / 8 | |
| 1.1.11 | 17 / 8 | |
| 1.1.9 | 17 / 8 | |
| 1.1.8 | 17 / 8 | |
| 1.1.7 | 17 / 8 | |
| 1.1.6 | 17 / 8 | |
| 1.1.5 | 17 / 8 | |
| 1.1.4 | 17 / 8 | |
| 1.1.3 | 17 / 8 | |
| 1.1.2 | 16 / 8 | |
| 1.1.1 | 16 / 8 | |
| 1.1.0 | 16 / 8 | |
| 1.0.12 | 16 / 8 | |
| 1.0.11 | 15 / 8 | |
| 1.0.10 | 15 / 8 | |
| 1.0.9 | 15 / 8 | |
| 1.0.8 | 15 / 8 | |
| 1.0.7 | 14 / 8 | |
| 1.0.6 | 14 / 8 | |
| 1.0.5 | 13 / 8 | |
| 1.0.4 | 13 / 8 | |
| 1.0.3 | 12 / 8 | |
| 1.0.2 | 12 / 8 | |
| 1.0.1 | 12 / 8 | |
| 1.0.0 | 12 / 8 |