jspm
Import Map Package Manager
79
Versions
Apache-2.0
License
No
Install Scripts
Missing
Provenance
Supply chain provenance
Status for the latest visible version.
No SLSA provenance
npm registry signatures
gitHead linked
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
guybedfordjkrishna
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| provenance | publisher-changed | AI (provenance): guybedford is the canonical jspm author/creator with a long established track record (2190 approved packages, 4751 days). The transition back to this account is legitimate. | ai | |
| phantom-deps | phantom-dep:cac | AI (phantom-deps): cac is a declared runtime dependency used in the bundled CLI output; phantom detection is a false positive for bundled packages. | ai | |
| phantom-deps | phantom-dep:rollup | AI (phantom-deps): rollup is a declared runtime dependency used in the bundled output; phantom detection is a false positive for bundled packages. | ai | |
| phantom-deps | phantom-dep:@jspm/generator | AI (phantom-deps): jspm is a bundled CLI tool; dependencies are compiled into dist/ rather than directly imported at runtime. | ai | |
| source-diff | encoded-string-file:dist/cli.js | AI (source-diff): The encoded string is a base64-encoded WebAssembly binary (wasm-bindgen output). The AGFzbQ prefix confirms WASM magic bytes. This is a standard pattern for shipping compiled WASM in a JS CLI bundle. | ai | |
| phantom-deps | phantom-dep:@jspm/plugin-rollup | AI (phantom-deps): jspm is a bundled CLI tool; dependencies are compiled into dist/ rather than directly imported at runtime. | ai | |
| phantom-deps | phantom-dep:ora | AI (phantom-deps): jspm is a bundled CLI tool; dependencies are compiled into dist/ rather than directly imported at runtime. Phantom dep findings are false positives for this package. | ai | |
| phantom-deps | phantom-dep:@babel/core | AI (phantom-deps): jspm is a bundled CLI tool; dependencies are compiled into dist/ rather than directly imported at runtime. | ai |
Versions (showing 79 of 179)
| Version | Deps | Published |
|---|---|---|
| 0.11.4 | 17 / 1 | |
| 0.11.3 | 17 / 1 | |
| 0.11.2 | 17 / 1 | |
| 0.11.1 | 17 / 1 | |
| 0.11.0 | 17 / 1 | |
| 0.10.6 | 17 / 1 | |
| 0.10.5 | 17 / 1 | |
| 0.10.4 | 17 / 1 | |
| 0.10.3 | 17 / 1 | |
| 0.10.2 | 17 / 1 | |
| 0.10.1 | 17 / 1 | |
| 0.10.0 | 17 / 1 | |
| 0.9.0 | 17 / 1 | |
| 0.8.6 | 17 / 1 | |
| 0.8.5 | 17 / 1 | |
| 0.8.4 | 16 / 1 | |
| 0.8.3 | 16 / 1 | |
| 0.8.2 | 16 / 1 | |
| 0.8.1 | 16 / 1 | |
| 0.8.0 | 16 / 1 | |
| 0.7.3 | 14 / 1 | |
| 0.7.2 | 14 / 1 | |
| 0.7.1 | 14 / 1 | |
| 0.7.0 | 14 / 1 | |
| 0.6.13 | 13 / 1 | |
| 0.6.12 | 13 / 1 | |
| 0.6.11 | 13 / 1 | |
| 0.6.10 | 13 / 1 | |
| 0.6.9 | 13 / 1 | |
| 0.6.8 | 13 / 1 | |
| 0.6.7 | 13 / 1 | |
| 0.6.6 | 13 / 1 | |
| 0.6.5 | 13 / 1 | |
| 0.6.4 | 13 / 1 | |
| 0.6.3 | 13 / 1 | |
| 0.6.2 | 13 / 1 | |
| 0.6.1 | 13 / 1 | |
| 0.6.0 | 13 / 1 | |
| 0.5.16 | 12 / 1 | |
| 0.5.15 | 12 / 1 | |
| 0.5.14 | 11 / 1 | |
| 0.5.13 | 11 / 1 | |
| 0.5.12 | 11 / 1 | |
| 0.5.11 | 11 / 1 | |
| 0.5.10 | 11 / 1 | |
| 0.5.9 | 11 / 1 | |
| 0.5.8 | 11 / 1 | |
| 0.5.7 | 11 / 1 | |
| 0.5.6 | 11 / 1 | |
| 0.5.5 | 11 / 1 | |
| 0.5.4 | 11 / 1 | |
| 0.5.3 | 11 / 1 | |
| 0.5.2 | 12 / 1 | |
| 0.4.3 | 9 / 0 | |
| 0.4.2 | 9 / 0 | |
| 0.4.1 | 9 / 0 | |
| 0.4.0 | 9 / 0 | |
| 0.3.10 | 9 / 0 | |
| 0.3.9 | 9 / 0 | |
| 0.3.8 | 9 / 0 | |
| 0.3.7 | 9 / 0 | |
| 0.3.6 | 9 / 0 | |
| 0.3.5 | 9 / 0 | |
| 0.3.4 | 9 / 0 | |
| 0.3.3 | 9 / 0 | |
| 0.3.2 | 9 / 0 | |
| 0.3.1 | 9 / 0 | |
| 0.3.0 | 9 / 0 | |
| 0.2.0 | 8 / 0 | |
| 0.1.1 | 8 / 0 | |
| 0.1.0 | 6 / 0 | |
| 0.0.8 | 2 / 0 | |
| 0.0.7 | 2 / 0 | |
| 0.0.6 | 2 / 0 | |
| 0.0.5 | 1 / 0 | |
| 0.0.4 | 1 / 0 | |
| 0.0.3 | 1 / 0 | |
| 0.0.2 | 2 / 0 | |
| 0.0.1 | 2 / 0 |