rttc
Runtime type-checking for JavaScript.
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| email-domain | unclaimed-email:particlebanana | AI (email-domain): The author field uses '@particlebanana' as a social handle (Twitter/GitHub), not an email address. No actual email domain is at risk of hijacking here. | ai | |
| provenance | publisher-changed | AI (provenance): rachaelshaw is a named contributor in package.json and has a strong track record (753 approved). This is an internal Sails Company team transition, not a hostile takeover. | ai | |
| maintainer-change | maintainer-added | AI (maintainer-change): rachaelshaw is a listed contributor in package.json and a well-established publisher in the Sails ecosystem. | ai | |
| maintainer-change | maintainer-removed | AI (maintainer-change): Removed maintainers are all listed as contributors; this reflects an intentional org restructuring within The Sails Company, not a takeover. | ai | |
| publish-pattern | new-deps-added | AI (publish-pattern): @sailshq/lodash is the Sails Company's own scoped lodash fork, a direct replacement for the lodash dep. Not a suspicious third-party injection. | ai | |
| semgrep | semgrep:eval-usage | AI (semgrep): eval() is used to reconstruct a function from a pre-validated stringified function literal — a legitimate pattern in a runtime type-checking/hydration library. | ai |
Versions (showing 100 of 102)
| Version | Deps | Published |
|---|---|---|
| 10.0.1 | 1 / 2 | |
| 10.0.0 | 1 / 2 | |
| 9.8.2 | 1 / 1 | |
| 9.8.1 | 1 / 1 | |
| 9.8.0 | 1 / 1 | |
| 9.7.2 | 1 / 1 | |
| 9.7.1 | 1 / 1 | |
| 9.7.0 | 1 / 1 | |
| 9.6.3 | 1 / 1 | |
| 9.6.2 | 1 / 1 | |
| 9.6.1 | 1 / 1 | |
| 9.6.0 | 1 / 1 | |
| 9.5.1 | 1 / 1 | |
| 9.5.0 | 1 / 1 | |
| 9.4.0 | 1 / 1 | |
| 9.3.4 | 1 / 1 | |
| 9.3.3 | 1 / 1 | |
| 9.3.2 | 1 / 1 | |
| 9.3.1 | 1 / 1 | |
| 9.3.0 | 1 / 1 | |
| 9.2.4 | 1 / 1 | |
| 9.2.3 | 1 / 1 | |
| 9.2.2 | 1 / 1 | |
| 9.2.1 | 1 / 1 | |
| 9.2.0 | 1 / 1 | |
| 9.1.0 | 1 / 1 | |
| 9.0.0 | 1 / 1 | |
| 8.1.7 | 1 / 1 | |
| 8.1.6 | 1 / 1 | |
| 8.1.5 | 1 / 1 | |
| 8.1.4 | 1 / 1 | |
| 8.1.3 | 1 / 1 | |
| 8.1.2 | 1 / 1 | |
| 8.1.1 | 1 / 1 | |
| 8.1.0 | 1 / 1 | |
| 8.0.0 | 1 / 1 | |
| 7.4.0 | 1 / 1 | |
| 7.3.0 | 1 / 1 | |
| 7.2.1 | 1 / 1 | |
| 7.2.0 | 1 / 1 | |
| 7.1.0 | 1 / 1 | |
| 7.0.1 | 1 / 1 | |
| 7.0.0 | 1 / 1 | |
| 6.0.0 | 1 / 1 | |
| 5.2.0 | 1 / 1 | |
| 5.1.1 | 1 / 1 | |
| 5.1.0 | 1 / 1 | |
| 5.0.1 | 1 / 1 | |
| 5.0.0 | 1 / 1 | |
| 4.5.2 | 1 / 1 | |
| 4.5.1 | 1 / 1 | |
| 4.5.0 | 1 / 1 | |
| 4.4.3 | 1 / 1 | |
| 4.4.2 | 1 / 1 | |
| 4.4.1 | 1 / 1 | |
| 4.4.0 | 1 / 1 | |
| 4.3.1 | 1 / 1 | |
| 4.3.0 | 1 / 1 | |
| 4.2.1 | 1 / 1 | |
| 4.2.0 | 1 / 1 | |
| 4.1.2 | 1 / 1 | |
| 4.1.1 | 1 / 1 | |
| 4.1.0 | 1 / 1 | |
| 4.0.6 | 1 / 1 | |
| 4.0.5 | 1 / 1 | |
| 4.0.4 | 1 / 1 | |
| 4.0.3 | 1 / 1 | |
| 4.0.2 | 1 / 1 | |
| 4.0.1 | 1 / 1 | |
| 4.0.0 | 1 / 1 | |
| 3.4.0 | 1 / 1 | |
| 3.3.0 | 1 / 1 | |
| 3.2.0 | 1 / 1 | |
| 3.1.3 | 1 / 1 | |
| 3.1.2 | 1 / 1 | |
| 3.0.4 | 1 / 1 | |
| 3.0.2 | 1 / 1 | |
| 3.0.1 | 1 / 1 | |
| 3.0.0 | 1 / 1 | |
| 2.0.6 | 1 / 1 | |
| 2.0.5 | 1 / 1 | |
| 2.0.4 | 1 / 1 | |
| 2.0.3 | 1 / 1 | |
| 2.0.2 | 1 / 1 | |
| 2.0.1 | 1 / 1 | |
| 1.0.2 | 1 / 1 | |
| 1.0.1 | 1 / 1 | |
| 1.0.0 | 1 / 1 | |
| 0.6.0 | 1 / 1 | |
| 0.5.0 | 1 / 1 | |
| 0.3.1 | 1 / 1 | |
| 0.2.4 | 1 / 1 | |
| 0.2.3 | 1 / 1 | |
| 0.2.2 | 1 / 1 | |
| 0.2.1 | 1 / 1 | |
| 0.2.0 | 1 / 1 | |
| 0.1.6 | 1 / 1 | |
| 0.1.5 | 1 / 1 | |
| 0.1.4 | 1 / 1 | |
| 0.1.3 | 1 / 1 |
v10.0.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v10.0.0
2 findingsThis version was published by a different npm account than previous versions on 2019-04-15. This could indicate a legitimate maintainer transition or an account compromise.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.8.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.8.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.8.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.7.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.7.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.7.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.6.3
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.6.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.6.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.6.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.5.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.5.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.4.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.3.4
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.3.3
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.3.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.3.1
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2016-03-31. This could indicate a legitimate maintainer transition or an account compromise.
v9.3.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.2.4
2 findingsMaintainer email '@particlebanana' uses domain 'particlebanana' which has no DNS records. An attacker could register this domain to hijack the maintainer identity.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.2.3
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2015-10-19. This could indicate a legitimate maintainer transition or an account compromise.
v9.2.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.2.1
3 findingsMaintainer email '@particlebanana' uses domain 'particlebanana' which has no DNS records. An attacker could register this domain to hijack the maintainer identity.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2015-10-07. This could indicate a legitimate maintainer transition or an account compromise.
v9.2.0
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2015-09-15. This could indicate a legitimate maintainer transition or an account compromise.
v9.1.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.0.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.