graphql-language-service-interface
Interface to the GraphQL Language Service
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| maintainer-change | maintainer-added | AI (maintainer-change): New maintainers ags- and schickling are known graphiql community contributors added during the legitimate 2019 project transfer. | ai | |
| phantom-deps | phantom-dep:graphql-config | AI (phantom-deps): graphql-config is a declared dependency used transitively in this monorepo package; phantom-dep finding is a stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:graphql-language-service-types | AI (phantom-deps): graphql-language-service-types is a sibling monorepo package declared as a dep; phantom-dep finding is a stable false positive here. | ai | |
| provenance | publisher-changed | AI (provenance): Publisher change reflects the documented 2019 transfer of graphiql from Facebook to the GraphQL Foundation/community. Legitimate transition, not a compromise. | ai | |
| maintainer-change | maintainer-removed | AI (maintainer-change): Removal of fb maintainer is consistent with Facebook handing off graphiql to the community in 2019; not indicative of a takeover. | ai | |
| provenance | no-provenance | AI (provenance): Well-established package with strong publisher track record; lack of Sigstore attestation is a process gap, not a security risk for this package. | ai | |
| provenance | missing-githead | AI (provenance): Established graphql/graphiql monorepo package with clean version diff; missing gitHead reflects a publish environment change, not a security concern for this package. | ai |
Versions (showing 51 of 65)
| Version | Deps | Published |
|---|---|---|
| 2.10.2 | 5 / 2 | |
| 2.10.1 | 5 / 2 | |
| 2.10.0 | 5 / 2 | |
| 2.9.5 | 5 / 2 | |
| 2.9.4 | 5 / 2 | |
| 2.9.3 | 4 / 3 | |
| 2.9.2 | 4 / 3 | |
| 2.9.1 | 4 / 2 | |
| 2.9.0 | 4 / 2 | |
| 2.8.4 | 4 / 2 | |
| 2.8.3 | 4 / 1 | |
| 2.8.2 | 4 / 1 | |
| 2.8.1 | 4 / 1 | |
| 2.8.0 | 4 / 1 | |
| 2.7.0 | 4 / 1 | |
| 2.6.0 | 4 / 1 | |
| 2.5.0 | 4 / 1 | |
| 2.4.3 | 4 / 1 | |
| 2.4.2 | 4 / 1 | |
| 2.4.1 | 4 / 1 | |
| 2.4.0 | 4 / 1 | |
| 2.3.3 | 4 / 0 | |
| 2.3.2 | 4 / 0 | |
| 2.3.1 | 4 / 0 | |
| 2.3.0 | 4 / 0 | |
| 2.1.0 | 4 / 0 | |
| 2.0.0 | 4 / 0 | |
| 1.3.2 | 4 / 0 | |
| 1.2.2 | 4 / 0 | |
| 1.2.0 | 4 / 0 | |
| 1.1.0 | 4 / 0 | |
| 1.0.18 | 4 / 0 | |
| 1.0.16 | 4 / 0 | |
| 1.0.15 | 4 / 0 | |
| 0.1.14 | 4 / 0 | |
| 0.1.13 | 5 / 0 | |
| 0.1.12 | 5 / 0 | |
| 0.1.10 | 5 / 0 | |
| 0.1.8 | 5 / 0 | |
| 0.1.7 | 5 / 1 | |
| 0.1.6 | 5 / 1 | |
| 0.1.5 | 5 / 0 | |
| 0.0.23 | 5 / 0 | |
| 0.0.22 | 5 / 0 | |
| 0.0.21 | 5 / 0 | |
| 0.0.20 | 5 / 0 | |
| 0.0.19 | 5 / 0 | |
| 0.0.18 | 5 / 0 | |
| 0.0.17 | 5 / 0 | |
| 0.0.16 | 5 / 0 | |
| 0.0.15 | 5 / 0 |
v2.10.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.10.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.10.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.9.5
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.9.4
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.9.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.9.2
2 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: acao.
v2.9.1
2 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: acao.
v2.9.0
2 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: acao.
v2.8.4
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: acao.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.8.3
2 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: acao.
v2.8.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.8.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.8.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.7.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.6.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.5.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.4.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.4.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.4.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.4.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.3.3
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.3.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.3.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.3.0
3 findingsThis version was published by a different npm account than previous versions on 2019-10-04. This could indicate a legitimate maintainer transition or an account compromise.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: acao.
v2.1.0
3 findingsThis version was published by a different npm account than previous versions on 2019-08-18. This could indicate a legitimate maintainer transition or an account compromise.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: acao.
v2.0.0
3 findingsThis version was published by a different npm account than previous versions on 2018-09-18. This could indicate a legitimate maintainer transition or an account compromise.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: lostplan.
v1.3.2
2 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2018-09-06. This could indicate a legitimate maintainer transition or an account compromise.
v1.2.2
2 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2018-06-11. This could indicate a legitimate maintainer transition or an account compromise.
v1.2.0
2 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2018-06-04. This could indicate a legitimate maintainer transition or an account compromise.
v1.1.0
2 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2018-04-09. This could indicate a legitimate maintainer transition or an account compromise.
v1.0.18
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.16
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.15
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.19
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.