polished
A lightweight toolset for writing styles in Javascript.
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| provenance | missing-githead | AI (provenance): gitHead metadata can vary by publish environment; polished is a well-established package with verified authorship and no material code changes. | ai | |
| phantom-deps | phantom-dep:babel-plugin-preval | AI (phantom-deps): babel-plugin-preval is a Babel plugin referenced in config, not directly imported in source — expected pattern for this package. | ai | |
| provenance | no-provenance | AI (provenance): Package predates Sigstore provenance; publisher is long-established with strong track record. | ai | |
| source-diff | obfuscated-file:.yarn/releases/yarn-1.22.5.cjs | AI (source-diff): Vendored Yarn v1.22.5 release bundle (.yarn/releases/) is standard practice for reproducible builds; webpack-bundled package manager, not obfuscated malware. | ai | |
| source-diff | net-exec-file:.yarn/releases/yarn-1.22.5.cjs | AI (source-diff): Yarn package manager bundle naturally contains HTTP + eval patterns; this is the official Yarn 1.22.5 release, not a dropper. | ai | |
| source-diff | source-size-tripled | AI (source-diff): Size increase is entirely from vendored .yarn/releases/yarn-1.22.5.cjs (5.1MB) and install-state.gz (1.4MB); no malicious payload. | ai |
Versions (showing 51 of 82)
| Version | Deps | Published |
|---|---|---|
| 4.3.1 | 1 / 37 | |
| 4.3.0 | 1 / 38 | |
| 4.2.2 | 1 / 38 | |
| 4.2.1 | 1 / 38 | |
| 4.2.0 | 1 / 38 | |
| 4.1.4 | 1 / 38 | |
| 4.1.3 | 1 / 37 | |
| 4.1.2 | 1 / 37 | |
| 4.1.1 | 1 / 37 | |
| 4.1.0 | 2 / 37 | |
| 4.0.5 | 1 / 37 | |
| 4.0.4 | 1 / 37 | |
| 4.0.3 | 1 / 37 | |
| 4.0.2 | 1 / 37 | |
| 4.0.1 | 1 / 37 | |
| 3.7.2 | 1 / 37 | |
| 3.7.1 | 1 / 37 | |
| 3.7.0 | 2 / 37 | |
| 3.6.7 | 1 / 42 | |
| 3.6.6 | 1 / 42 | |
| 3.6.5 | 1 / 42 | |
| 3.6.4 | 1 / 42 | |
| 3.6.3 | 1 / 42 | |
| 3.6.2 | 1 / 42 | |
| 3.6.1 | 1 / 42 | |
| 3.6.0 | 1 / 42 | |
| 3.5.2 | 1 / 40 | |
| 3.5.1 | 1 / 40 | |
| 3.5.0 | 1 / 40 | |
| 3.4.4 | 1 / 44 | |
| 3.4.3 | 1 / 44 | |
| 3.4.2 | 1 / 42 | |
| 3.4.1 | 1 / 42 | |
| 3.4.0 | 1 / 42 | |
| 3.3.2 | 1 / 42 | |
| 3.3.1 | 1 / 42 | |
| 3.3.0 | 1 / 42 | |
| 3.2.1 | 1 / 42 | |
| 3.2.0 | 1 / 42 | |
| 3.1.0 | 1 / 42 | |
| 3.0.4 | 1 / 42 | |
| 3.0.3 | 1 / 42 | |
| 3.0.2 | 2 / 41 | |
| 3.0.1 | 2 / 41 | |
| 3.0.0 | 2 / 41 | |
| 2.3.3 | 1 / 42 | |
| 2.3.2 | 1 / 42 | |
| 2.3.1 | 1 / 42 | |
| 2.3.0 | 1 / 42 | |
| 2.2.0 | 1 / 42 | |
| 2.1.1 | 1 / 42 |
v4.3.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.3.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.2.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.2.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.2.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.1.4
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.1.3
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.1.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.1.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.1.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.0.5
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.0.4
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.0.3
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.0.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.0.1
3 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.7.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.7.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.7.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.6.7
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.6.6
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.6.5
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.6.4
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.6.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.6.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.6.1
2 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: bhough.
v3.6.0
2 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: bhough.
v3.5.2
2 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: bhough.
v3.5.1
2 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: bhough.
v3.5.0
2 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: bhough.
v3.4.4
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.4.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.4.2
2 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: bhough.
v3.4.1
2 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: bhough.
v3.4.0
2 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: bhough.
v3.3.2
2 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: bhough.
v3.3.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.3.0
2 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: bhough.
v3.2.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.2.0
2 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: bhough.
v3.1.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.0.4
2 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: bhough.
v3.0.3
2 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: bhough.
v3.0.2
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: bhough.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.0.1
2 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: bhough.
v3.0.0
2 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: bhough.