← Home

magic-string

npm Repository Homepage

Modify strings, generate sourcemaps

51
Versions
MIT
License
No
Install Scripts
Verified
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures No source commit

Maintainers

mournerrich_harrisalangpierceantfu

Keywords

stringstring manipulationsourcemaptemplatingtranspilation

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
provenance missing-githead AI (provenance): magic-string is a mature, well-trusted package; missing gitHead reflects a publish workflow change, not a supply chain compromise. antfu is a trusted publisher with strong track record. ai
provenance no-provenance AI (provenance): Lack of Sigstore attestation is a process gap, not a security risk, for this well-established package with 41 approved inbound edges. ai
provenance publisher-changed AI (provenance): The mourner→rich_harris transition in 2018 is a documented, legitimate handoff. Rich Harris is the named author and repo owner; this is stable for all versions of this package. ai

Versions (showing 51 of 123)

View all versions
Version Deps Published
0.30.21 1 / 13
0.30.19 1 / 13
0.30.18 1 / 13
0.30.17 1 / 13
0.30.16 1 / 13
0.30.15 1 / 12
0.30.14 1 / 12
0.30.13 1 / 12
0.30.12 1 / 12
0.30.11 1 / 12
0.30.10 1 / 12
0.30.9 1 / 12
0.30.8 1 / 12
0.30.7 1 / 12
0.30.6 1 / 12
0.30.5 1 / 12
0.30.4 1 / 12
0.30.3 1 / 12
0.30.2 1 / 12
0.30.1 1 / 12
0.30.0 1 / 12
0.29.0 1 / 12
0.28.0 1 / 12
0.27.0 1 / 11
0.26.7 1 / 11
0.26.6 1 / 11
0.26.5 1 / 11
0.26.4 1 / 11
0.26.3 1 / 11
0.26.2 1 / 10
0.26.1 1 / 10
0.26.0 1 / 10
0.25.9 1 / 11
0.25.8 1 / 11
0.25.7 1 / 9
0.25.6 1 / 9
0.25.5 1 / 9
0.25.4 1 / 9
0.25.3 1 / 9
0.25.2 1 / 10
0.25.1 1 / 10
0.25.0 1 / 10
0.24.1 1 / 10
0.24.0 1 / 10
0.23.2 1 / 14
0.23.1 1 / 14
0.23.0 1 / 14
0.22.5 1 / 14
0.22.4 1 / 14
0.22.3 1 / 14
0.22.2 1 / 14

v0.30.19

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.30.18

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.30.17

2 findings
HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: antfu.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.30.16

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.30.15

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.30.14

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.30.13

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.30.12

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.30.11

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.30.10

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.30.9

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.30.8

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.30.7

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.30.6

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.30.5

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.30.4

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.30.3

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.30.2

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.30.1

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.30.0

2 findings
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: rich_harris → antfu (on 2023-02-22) provenance

[Accepted risk] This version was published by a different npm account than previous versions on 2023-02-22. This could indicate a legitimate maintainer transition or an account compromise.

v0.29.0

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.28.0

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.27.0

2 findings
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: antfu → rich_harris (on 2022-12-03) provenance

[Accepted risk] This version was published by a different npm account than previous versions on 2022-12-03. This could indicate a legitimate maintainer transition or an account compromise.

v0.26.7

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.26.6

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.26.5

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.26.4

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.26.3

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.26.2

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.26.1

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.26.0

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.25.9

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.25.8

2 findings
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: rich_harris → antfu (on 2022-03-02) provenance

[Accepted risk] This version was published by a different npm account than previous versions on 2022-03-02. This could indicate a legitimate maintainer transition or an account compromise.

v0.25.7

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.25.6

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.25.5

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.25.4

2 findings
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: mourner → rich_harris (on 2019-09-30) provenance

[Accepted risk] This version was published by a different npm account than previous versions on 2019-09-30. This could indicate a legitimate maintainer transition or an account compromise.

v0.25.3

2 findings
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: rich_harris → mourner (on 2019-07-01) provenance

[Accepted risk] This version was published by a different npm account than previous versions on 2019-07-01. This could indicate a legitimate maintainer transition or an account compromise.

v0.25.2

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.25.1

2 findings
HIGH Publisher changed: mourner → rich_harris (on 2018-09-18) provenance

This version was published by a different npm account than previous versions on 2018-09-18. This could indicate a legitimate maintainer transition or an account compromise.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.25.0

2 findings
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: rich_harris → mourner (on 2018-05-31) provenance

[Accepted risk] This version was published by a different npm account than previous versions on 2018-05-31. This could indicate a legitimate maintainer transition or an account compromise.

v0.24.1

2 findings
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: mourner → rich_harris (on 2018-05-15) provenance

[Accepted risk] This version was published by a different npm account than previous versions on 2018-05-15. This could indicate a legitimate maintainer transition or an account compromise.

v0.24.0

2 findings
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: rich_harris → mourner (on 2018-03-19) provenance

[Accepted risk] This version was published by a different npm account than previous versions on 2018-03-19. This could indicate a legitimate maintainer transition or an account compromise.

v0.23.2

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.23.1

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.23.0

2 findings
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: alangpierce → rich_harris (on 2018-03-14) provenance

[Accepted risk] This version was published by a different npm account than previous versions on 2018-03-14. This could indicate a legitimate maintainer transition or an account compromise.

v0.22.5

2 findings
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: rich_harris → alangpierce (on 2018-03-14) provenance

[Accepted risk] This version was published by a different npm account than previous versions on 2018-03-14. This could indicate a legitimate maintainer transition or an account compromise.

v0.22.4

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.22.3

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.22.2

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.