jest-runner — Greenflagged

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.

Maintainers

aaronabramovsimenbrickhanloniiopenjs-operationscpojer

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
maintainer-change	maintainer-removed	AI (maintainer-change): Maintainer changes are consistent with Facebook/Jest project team transitions; this is a well-established, high-download official package with no signs of takeover.	ai	2026/04/23
phantom-deps	phantom-dep:jest-jasmine2	AI (phantom-deps): jest-jasmine2 is a test framework adapter referenced in config; phantom dependency is expected and benign.	ai	2026/04/23
maintainer-change	maintainer-added	AI (maintainer-change): simenb is the established maintainer of jest-runner since 2020; this is a stable, legitimate maintainer for the package.	ai	2026/04/23
publish-pattern	new-deps-added	AI (publish-pattern): New deps (exit, jest-worker, jest-leak-detector) are established packages / Jest monorepo siblings replacing worker-farm and pify.	ai	2026/04/23
provenance	publisher-changed	AI (provenance): Publisher transition from davidzilburg to simenb in 2020 reflects Jest project governance; stable for this package.	ai	2026/04/23
dependencies	unvetted-dep:exit-x	AI (dependencies): exit-x is a maintained replacement for the deprecated 'exit' package, used by Jest for process exit handling. Its use in jest-runner is intentional and documented in the Jest ecosystem.	ai	2026/04/23
provenance	no-provenance	AI (provenance): Package predates Sigstore provenance adoption; 43.7M weekly downloads and official Facebook authorship make this a stable false positive for this package.	ai	2026/04/23
dependencies	unvetted-dep:jest-jasmine2	AI (dependencies): jest-jasmine2 is a sibling package in the official Facebook/Meta Jest monorepo, published by the same trusted team. This dependency relationship is stable and expected across all jest-runner versions.	ai	2026/04/23
dependencies	unvetted-dep:jest-runtime	AI (dependencies): jest-runtime is a Jest monorepo sibling package; always published together with jest-runner at the same version. Not an independent supply chain risk.	ai	2026/04/23
dependencies	unvetted-dep:jest-watcher	AI (dependencies): jest-watcher is a Jest monorepo sibling package; always published together with jest-runner at the same version. Not an independent supply chain risk.	ai	2026/04/23
npm-metadata	no-description	AI (npm-metadata): Stub/placeholder version of a well-known package; absence of description is expected for this namespace reservation release.	ai	2026/04/23
npm-metadata	suspicious-initial-version	AI (npm-metadata): jest-runner 0.0.0 is a legitimate namespace placeholder by the Jest team (cpojer); the 0.0.0 version is a known monorepo stub pattern, not a malicious indicator for this package.	ai	2026/04/23
phantom-deps	phantom-dep:@types/node	AI (phantom-deps): Framework-scoped type package loaded by convention in Jest's architecture; not a real phantom dependency concern.	ai	2026/04/21
bogus-package	bogus-package	AI (bogus-package): jest-runner is a Jest monorepo package; inflated semver tracks the Jest release version, missing description/keywords are normal for monorepo sub-packages.	ai	2026/04/21
phantom-deps	phantom-dep:jest-environment-node	AI (phantom-deps): Referenced in config files as the default environment; expected phantom dep pattern for jest-runner.	ai	2026/04/21
phantom-deps	phantom-dep:@jest/environment	AI (phantom-deps): Jest environment interface loaded by convention; expected in jest-runner's architecture.	ai	2026/04/21

Versions (showing 100 of 154)

Version	Deps	Published
30.4.2	22 / 4	2026-05-09
30.4.1	22 / 4	2026-05-08
30.4.0	22 / 4	2026-05-07
30.3.0	22 / 4	2026-03-10
30.2.0	22 / 4	2025-09-28
30.1.3	22 / 4	2025-09-02
30.1.2	22 / 4	2025-09-01
30.1.1	22 / 4	2025-08-27
30.1.0	22 / 4	2025-08-27
30.0.5	22 / 4	2025-07-22
30.0.4	22 / 4	2025-07-02
30.0.3	22 / 4	2025-06-25
30.0.2	22 / 4	2025-06-19
30.0.1	22 / 4	2025-06-18
30.0.0	22 / 4	2025-06-10
29.7.0	21 / 7	2023-09-12
29.6.4	21 / 7	2023-08-24
29.6.3	21 / 7	2023-08-21
29.6.2	21 / 7	2023-07-27
29.6.1	21 / 7	2023-07-06
29.6.0	21 / 7	2023-07-04
29.5.0	21 / 7	2023-03-06
29.4.3	21 / 7	2023-02-15
29.4.2	21 / 7	2023-02-07
29.4.1	21 / 6	2023-01-26
29.4.0	21 / 6	2023-01-24
29.3.1	21 / 6	2022-11-08
29.3.0	21 / 6	2022-11-07
29.2.2	21 / 6	2022-10-24
29.2.1	21 / 6	2022-10-18
29.2.0	21 / 6	2022-10-14
29.1.2	21 / 6	2022-09-30
29.1.1	21 / 6	2022-09-28
29.1.0	21 / 6	2022-09-28
29.0.3	21 / 6	2022-09-10
29.0.2	21 / 6	2022-09-03
29.0.1	21 / 6	2022-08-26
29.0.0	21 / 6	2022-08-25
28.1.3	21 / 6	2022-07-13
28.1.2	21 / 6	2022-06-29
28.1.1	21 / 6	2022-06-07
28.1.0	21 / 6	2022-05-06
28.0.3	21 / 6	2022-04-29
28.0.2	21 / 6	2022-04-27
28.0.1	21 / 6	2022-04-26
28.0.0	21 / 6	2022-04-25
27.5.1	21 / 4	2022-02-08
27.5.0	21 / 4	2022-02-05
27.4.6	22 / 4	2022-01-04
27.4.5	22 / 4	2021-12-13
27.4.4	22 / 4	2021-12-10
27.4.3	22 / 4	2021-12-01
27.4.2	22 / 4	2021-11-30
27.4.1	22 / 4	2021-11-30
27.4.0	22 / 4	2021-11-29
27.3.1	22 / 4	2021-10-19
27.3.0	22 / 4	2021-10-17
27.2.5	22 / 4	2021-10-08
27.2.4	22 / 4	2021-09-29
27.2.3	22 / 4	2021-09-28
27.2.2	22 / 4	2021-09-25
27.2.1	22 / 4	2021-09-20
27.2.0	22 / 4	2021-09-13
27.1.1	22 / 4	2021-09-08
27.1.0	22 / 4	2021-08-27
27.0.6	22 / 4	2021-06-28
27.0.5	22 / 4	2021-06-22
27.0.4	22 / 4	2021-06-03
27.0.3	20 / 4	2021-05-29
27.0.2	20 / 4	2021-05-29
27.0.1	21 / 4	2021-05-25
27.0.0	21 / 4	2021-05-25
26.6.3	20 / 4	2020-11-04
26.6.2	20 / 4	2020-11-02
26.6.1	20 / 4	2020-10-23
26.6.0	20 / 4	2020-10-19
26.5.3	20 / 4	2020-10-11
26.5.2	20 / 4	2020-10-06
26.5.1	20 / 4	2020-10-05
26.5.0	20 / 4	2020-10-05
26.4.2	20 / 4	2020-08-22
26.4.1	20 / 4	2020-08-20
26.4.0	20 / 4	2020-08-12
26.3.0	20 / 4	2020-08-10
26.2.2	20 / 4	2020-07-31
26.2.1	20 / 4	2020-07-30
26.2.0	20 / 4	2020-07-30
26.1.0	19 / 5	2020-06-23
26.0.1	19 / 5	2020-05-05
26.0.0	19 / 5	2020-05-04
25.5.4	19 / 5	2020-05-02
25.5.3	19 / 5	2020-04-30
25.5.2	19 / 5	2020-04-29
25.5.1	19 / 5	2020-04-29
25.5.0	19 / 5	2020-04-28
25.4.0	19 / 5	2020-04-19
25.3.0	19 / 5	2020-04-08
25.2.7	19 / 5	2020-04-03
25.2.6	19 / 5	2020-04-02
25.2.4	19 / 5	2020-03-29

Showing 100 of 154 Next page →

v30.4.2

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v30.4.1

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v30.4.0

2 findings

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: cpojer → simenb (on 2026-05-07) provenance

[Accepted risk] This version was published by a different npm account than previous versions on 2026-05-07. This could indicate a legitimate maintainer transition or an account compromise.

v30.3.0

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v30.2.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v30.1.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v30.1.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v30.1.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v30.1.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v30.0.5

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v30.0.4

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v30.0.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v30.0.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v30.0.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v30.0.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v29.7.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v29.6.4

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v29.6.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v29.6.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v29.6.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v29.6.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v29.5.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v29.4.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v29.4.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v29.4.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v29.4.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v29.3.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v29.3.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v29.2.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v29.2.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v29.2.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v29.1.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v29.1.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v29.1.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v29.0.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v29.0.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v29.0.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v29.0.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v28.1.3

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v28.1.2

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v28.1.1

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v28.1.0

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v28.0.3

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v28.0.2

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v28.0.1

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v28.0.0

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v27.5.1

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v27.5.0

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v27.4.6

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v27.4.5

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v27.4.4

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v27.4.3

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v27.4.2

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v27.4.1

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v27.4.0

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v27.3.1

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v27.3.0

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v27.2.5

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v27.2.4

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v27.2.3

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v27.2.2

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v27.2.1

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v27.2.0

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v27.1.1

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v27.1.0

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v27.0.6

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v27.0.5

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v27.0.4

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v27.0.3

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v27.0.2

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v27.0.1

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v27.0.0

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v26.6.3

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v26.6.2

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v26.6.1

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v26.6.0

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v26.5.3

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v26.5.2

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v26.5.1

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v26.5.0

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v26.4.2

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v26.4.1

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v26.4.0

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v26.3.0

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v26.2.2

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v26.2.1

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v26.2.0

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v26.1.0

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v26.0.1

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v26.0.0

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v25.5.4

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v25.5.3

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v25.5.2

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v25.5.1

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v25.5.0

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v25.4.0

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v25.3.0

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v25.2.7

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v25.2.6

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v25.2.4

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.