jest-runtime — Greenflagged

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.

Maintainers

aaronabramovsimenbrickhanloniiopenjs-operationscpojer

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
dependencies	unvetted-dep:fast-json-stable-stringify	AI (dependencies): fast-json-stable-stringify is an established utility; unvetted status is a false positive for this well-known package.	ai	2026/04/23
phantom-deps	phantom-dep:exit	AI (phantom-deps): exit is a known phantom dependency pattern in Jest; stable for this package.	ai	2026/04/23
provenance	publisher-changed	AI (provenance): Publisher change is documented as legitimate maintainer transition within the official Jest project.	ai	2026/04/23
provenance	no-provenance	AI (provenance): This is a 2017 release predating Sigstore provenance; no provenance is expected and not a risk signal for this package.	ai	2026/04/23
maintainer-change	maintainer-removed	AI (maintainer-change): Documented maintainer transition within Jest project; stable for this package.	ai	2026/04/23
maintainer-change	maintainer-added	AI (maintainer-change): Legitimate Jest project maintainer expansion; stable for this package.	ai	2026/04/23
dependencies	unvetted-dep:babel-core	AI (dependencies): babel-core is essential for jest-runtime's transpilation function; stable dependency.	ai	2026/04/23
publish-pattern	new-deps-added	AI (publish-pattern): New dependencies are all established packages (slash, realpath-native, write-file-atomic); no suspicious additions.	ai	2026/04/23
phantom-deps	phantom-dep:babel-jest	AI (phantom-deps): babel-jest is a legitimate Jest plugin referenced in config; phantom-dep status is expected.	ai	2026/04/23
phantom-deps	phantom-dep:jest-snapshot	AI (phantom-deps): jest-snapshot is a core Jest module referenced in config; phantom-dep status is expected.	ai	2026/04/23
dependencies	unvetted-dep:@jest/fake-timers	AI (dependencies): Sibling monorepo package published simultaneously; unvetted status is transient, not a security concern for jest-runtime.	ai	2026/04/23
dependencies	unvetted-dep:@jest/globals	AI (dependencies): Sibling monorepo package published simultaneously; unvetted status is transient, not a security concern for jest-runtime.	ai	2026/04/23
dependencies	unvetted-dep:jest-snapshot	AI (dependencies): Sibling monorepo package published simultaneously; unvetted status is transient, not a security concern for jest-runtime.	ai	2026/04/23
dependencies	unvetted-dep:@jest/source-map	AI (dependencies): Sibling monorepo package published simultaneously; unvetted status is transient, not a security concern for jest-runtime.	ai	2026/04/23
dependencies	unvetted-dep:collect-v8-coverage	AI (dependencies): collect-v8-coverage is a well-known utility used by Jest for V8 coverage collection; stable dependency with no security concerns.	ai	2026/04/23
npm-metadata	suspicious-initial-version	AI (npm-metadata): jest-runtime is a core Jest package by trusted maintainer cpojer; 0.0.0 is a namespace reservation placeholder, not a malicious throwaway package.	ai	2026/04/23
npm-metadata	no-description	AI (npm-metadata): Missing description is common in Jest monorepo packages; not a malware indicator here.	ai	2026/04/23
bogus-package	bogus-package	AI (bogus-package): jest-runtime is a monorepo workspace package with 327 prior versions; inflated-semver and missing-description signals are false positives for established internal packages.	ai	2026/04/21
phantom-deps	phantom-dep:chalk	AI (phantom-deps): chalk is a declared runtime dependency; phantom-dep false positive for this package.	ai	2026/04/21
phantom-deps	phantom-dep:@jest/fake-timers	AI (phantom-deps): @jest/fake-timers is a declared runtime dependency; phantom-dep false positive for this package.	ai	2026/04/21
phantom-deps	phantom-dep:@types/node	AI (phantom-deps): @types/node is a framework-scoped type dependency; phantom-dep false positive for this package.	ai	2026/04/21
phantom-deps	phantom-dep:jest-mock	AI (phantom-deps): jest-mock is a declared runtime dependency used by the Jest runtime; phantom-dep false positive.	ai	2026/04/21

Versions (showing 86 of 186)

Version	Deps	Published
25.2.1	25 / 7	2020-03-26
25.2.0	25 / 8	2020-03-25
25.1.0	25 / 4	2020-01-22
25.0.0	23 / 4	2019-08-22
24.9.0	23 / 6	2019-08-16
24.8.0	23 / 6	2019-05-05
24.7.1	23 / 6	2019-04-04
24.7.0	23 / 6	2019-04-03
24.6.0	23 / 6	2019-04-01
24.5.0	23 / 6	2019-03-12
24.4.0	23 / 6	2019-03-11
24.3.1	23 / 6	2019-03-07
24.3.0	23 / 6	2019-03-07
24.1.0	22 / 2	2019-02-05
24.0.0	22 / 2	2019-01-25
23.6.0	21 / 2	2018-09-10
23.5.0	21 / 2	2018-08-10
23.4.2	21 / 2	2018-07-27
23.4.1	21 / 2	2018-07-13
23.4.0	21 / 2	2018-07-10
23.3.0	21 / 2	2018-07-04
23.2.0	21 / 2	2018-06-25
23.1.0	21 / 2	2018-05-30
23.0.1	21 / 2	2018-05-27
23.0.0	21 / 2	2018-05-24
22.4.4	20 / 2	2018-05-18
22.4.3	20 / 2	2018-03-21
22.4.2	20 / 2	2018-02-22
22.4.1	20 / 2	2018-02-22
22.4.0	20 / 2	2018-02-20
22.3.0	19 / 2	2018-02-13
22.2.2	19 / 2	2018-02-09
22.2.1	19 / 2	2018-02-07
22.2.0	19 / 2	2018-02-07
22.1.4	19 / 2	2018-01-19
22.1.3	19 / 2	2018-01-18
22.1.2	19 / 2	2018-01-17
22.1.1	19 / 2	2018-01-15
22.1.0	18 / 2	2018-01-15
22.0.6	18 / 2	2018-01-11
22.0.5	18 / 2	2018-01-09
22.0.4	18 / 2	2017-12-22
22.0.3	18 / 2	2017-12-19
22.0.2	18 / 2	2017-12-19
22.0.1	18 / 2	2017-12-18
22.0.0	18 / 2	2017-12-18
21.2.1	17 / 2	2017-09-27
21.2.0	17 / 2	2017-09-26
21.1.0	17 / 2	2017-09-14
21.0.2	17 / 2	2017-09-08
21.0.0	17 / 2	2017-09-04
20.0.4	15 / 2	2017-05-24
20.0.3	15 / 2	2017-05-17
20.0.2	15 / 2	2017-05-17
20.0.1	15 / 2	2017-05-11
20.0.0	15 / 2	2017-05-06
19.0.4	15 / 2	2017-06-01
19.0.3	15 / 2	2017-04-26
19.0.2	15 / 2	2017-02-23
19.0.1	15 / 2	2017-02-22
19.0.0	15 / 2	2017-02-21
18.1.0	15 / 3	2016-12-29
18.0.0	15 / 3	2016-12-15
17.0.3	15 / 3	2016-11-17
17.0.2	15 / 3	2016-11-15
17.0.1	15 / 3	2016-11-14
17.0.0	15 / 3	2016-11-08
16.0.2	15 / 3	2016-10-20
16.0.0	15 / 3	2016-10-03
15.1.1	15 / 3	2016-09-02
15.1.0	15 / 3	2016-09-01
15.0.1	15 / 3	2016-09-01
15.0.0	15 / 3	2016-08-31
14.1.0	14 / 2	2016-08-01
14.0.1	11 / 2	2016-07-29
14.0.0	11 / 2	2016-07-27
13.2.3	10 / 1	2016-07-07
13.2.2	10 / 1	2016-07-07
13.2.1	10 / 1	2016-07-07
13.2.0	10 / 1	2016-07-07
13.1.3	10 / 1	2016-07-07
13.1.2	10 / 1	2016-07-07
13.1.1	10 / 1	2016-07-06
13.1.0	10 / 1	2016-07-05
13.0.0	10 / 1	2016-06-22
0.0.0	0 / 0	2016-05-19

v25.2.1

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v25.2.0

2 findings

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: scotthovestadt → simenb (on 2020-03-25) provenance

[Accepted risk] This version was published by a different npm account than previous versions on 2020-03-25. This could indicate a legitimate maintainer transition or an account compromise.

v25.1.0

2 findings

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: scotthovestadt → davidzilburg (on 2020-01-22) provenance

[Accepted risk] This version was published by a different npm account than previous versions on 2020-01-22. This could indicate a legitimate maintainer transition or an account compromise.

v25.0.0

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v24.9.0

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v24.8.0

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v24.7.1

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v24.7.0

2 findings

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: rubennorte → scotthovestadt (on 2019-04-03) provenance

[Accepted risk] This version was published by a different npm account than previous versions on 2019-04-03. This could indicate a legitimate maintainer transition or an account compromise.

v24.6.0

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v24.5.0

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v24.4.0

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v24.3.1

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v24.3.0

2 findings

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: mjesun → rubennorte (on 2019-03-07) provenance

[Accepted risk] This version was published by a different npm account than previous versions on 2019-03-07. This could indicate a legitimate maintainer transition or an account compromise.

v24.1.0

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v24.0.0

2 findings

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: mjesun → rubennorte (on 2019-01-25) provenance

[Accepted risk] This version was published by a different npm account than previous versions on 2019-01-25. This could indicate a legitimate maintainer transition or an account compromise.

v23.6.0

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v23.5.0

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v23.4.2

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v23.4.1

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v23.4.0

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v23.3.0

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v23.2.0

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v23.1.0

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v23.0.1

2 findings

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: cpojer → mjesun (on 2018-05-27) provenance

[Accepted risk] This version was published by a different npm account than previous versions on 2018-05-27. This could indicate a legitimate maintainer transition or an account compromise.

v23.0.0

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v22.4.4

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v22.4.3

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v22.4.2

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v22.4.1

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v22.4.0

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v22.3.0

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v22.2.2

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v22.2.1

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v22.2.0

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v22.1.4

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v22.1.3

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v22.1.2

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v22.1.1

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v22.1.0

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v22.0.6

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v22.0.5

2 findings

HIGH Publisher changed: cpojer → mjesun (on 2018-01-09) provenance

This version was published by a different npm account than previous versions on 2018-01-09. This could indicate a legitimate maintainer transition or an account compromise.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v22.0.4

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v22.0.3

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v22.0.2

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v22.0.1

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v22.0.0

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v21.2.1

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v21.2.0

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v21.1.0

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v21.0.2

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v21.0.0

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v20.0.4

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v20.0.3

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v20.0.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v20.0.1

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v20.0.0

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v19.0.4

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v19.0.3

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v19.0.2

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v19.0.1

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v19.0.0

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v18.1.0

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v18.0.0

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v17.0.3

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v17.0.2

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v17.0.1

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v17.0.0

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v16.0.2

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v16.0.0

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v15.1.1

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v15.1.0

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v15.0.1

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v15.0.0

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v14.1.0

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v14.0.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v14.0.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v13.2.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v13.2.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v13.2.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v13.2.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v13.1.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v13.1.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v13.1.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v13.1.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v13.0.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.0.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.