grunt-contrib-compress
Compress files and folders
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| dependencies | unvetted-dep:stream-buffers | AI (dependencies): stream-buffers is a well-known, benign Node.js utility package; its use is consistent with grunt-contrib-compress's file compression purpose. | ai | |
| provenance | publisher-changed | AI (provenance): Publisher change vladikoff→xhmikosr in Jan 2017 is a documented legitimate maintainer transition within the gruntjs org. xhmikosr has 722 approved packages and strong track record. | ai | |
| maintainer-change | maintainer-added | AI (maintainer-change): xhmikosr is an established maintainer added as part of the legitimate gruntjs org transition; not a hostile takeover. | ai | |
| provenance | no-provenance | AI (provenance): Package predates Sigstore provenance infrastructure (published 2017); absence of attestation is expected for this era. | ai | |
| publish-pattern | dormant-publish | AI (publish-pattern): grunt-contrib-compress is an official Grunt Team plugin; long gaps between releases are normal for stable build-tool plugins. No signs of account takeover. | ai | |
| phantom-deps | phantom-dep:adm-zip | AI (phantom-deps): adm-zip is a legitimate compression library; its use may be conditional or indirect within the compression plugin's task code. | ai |
Versions (showing 37 of 37)
| Version | Deps | Published |
|---|---|---|
| 2.0.0 | 6 / 8 | |
| 1.1.1 | 4 / 9 | |
| 1.1.0 | 4 / 9 | |
| 1.0.0 | 3 / 8 | |
| 0.14.0 | 3 / 8 | |
| 0.13.0 | 3 / 7 | |
| 0.12.0 | 3 / 7 | |
| 0.11.0 | 2 / 7 | |
| 0.10.0 | 2 / 7 | |
| 0.9.1 | 2 / 7 | |
| 0.9.0 | 2 / 7 | |
| 0.8.0 | 2 / 7 | |
| 0.7.0 | 2 / 7 | |
| 0.6.1 | 2 / 7 | |
| 0.6.0 | 2 / 7 | |
| 0.5.3 | 3 / 7 | |
| 0.5.2 | 3 / 7 | |
| 0.5.1 | 3 / 7 | |
| 0.5.0 | 3 / 7 | |
| 0.4.10 | 3 / 7 | |
| 0.4.9 | 3 / 7 | |
| 0.4.8 | 3 / 7 | |
| 0.4.7 | 2 / 7 | |
| 0.4.6 | 2 / 5 | |
| 0.4.5 | 2 / 5 | |
| 0.4.4 | 2 / 5 | |
| 0.4.3 | 2 / 5 | |
| 0.4.2 | 2 / 5 | |
| 0.4.1 | 4 / 5 | |
| 0.4.0 | 3 / 5 | |
| 0.3.3 | 5 / 2 | |
| 0.3.2 | 5 / 2 | |
| 0.3.1 | 5 / 2 | |
| 0.3.0 | 5 / 2 | |
| 0.2.2 | 5 / 2 | |
| 0.2.1 | 5 / 2 | |
| 0.2.0 | 6 / 1 |
v2.0.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.1.1
2 findingsThis version was published by a different npm account than previous versions on 2016-03-08. This could indicate a legitimate maintainer transition or an account compromise.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.1.0
2 findingsThis version was published by a different npm account than previous versions on 2016-03-04. This could indicate a legitimate maintainer transition or an account compromise.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.0
2 findingsThis version was published by a different npm account than previous versions on 2016-02-16. This could indicate a legitimate maintainer transition or an account compromise.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.