schema-utils MIT 43 versions

schema-utils

npm Repository Homepage

webpack Validation Utils

43

Versions

MIT

License

No

Install Scripts

Missing

Provenance

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.

Maintainers

sokraevilebottnawi

Keywords

webpack

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
dependencies	unvetted-dep:ajv-formats	AI (dependencies): ajv-formats is a well-known, widely-used AJV ecosystem package; its unvetted status is a registry artifact, not a security concern for this package.	ai	2026/04/22
dependencies	unvetted-dep:ajv-keywords	AI (dependencies): ajv-keywords is a well-known, widely-used AJV ecosystem package; its unvetted status is a registry artifact, not a security concern for this package.	ai	2026/04/22
maintainer-change	maintainer-added	AI (maintainer-change): michael-ciniawsky is an established webpack-contrib contributor; addition is a legitimate maintainer transition, not a compromise.	ai	2026/04/22
provenance	publisher-changed	AI (provenance): michael-ciniawsky is a known webpack-contrib maintainer with strong track record; transition from d3viant0ne is a legitimate org handoff within webpack-contrib.	ai	2026/04/22
publish-pattern	new-deps-added	AI (publish-pattern): ajv-errors is a legitimate, well-known AJV ecosystem package appropriate for a schema validation utility.	ai	2026/04/22
install-scripts	install-script:postinstall	AI (install-scripts): Postinstall script is a documented build step for webpack utilities; uses child_process for legitimate setup tasks, not malicious code execution.	ai	2026/04/22
semgrep	semgrep:child-process-import	AI (semgrep): child_process import in postinstall is legitimate for build/setup scripts in webpack ecosystem packages; no evidence of malicious use.	ai	2026/04/22
phantom-deps	phantom-dep:@types/json-schema	AI (phantom-deps): @types/json-schema is intentionally listed as a runtime dep in schema-utils to expose TypeScript types to consumers; this is a stable, documented pattern for this package.	ai	2026/04/21

Versions (showing 43 of 43)

Version	Deps	Published
4.3.3	4 / 31	2025-10-02
4.3.2	4 / 21	2025-04-22
4.3.1	4 / 21	2025-04-22
4.3.0	4 / 21	2024-12-11
4.2.0	4 / 21	2023-06-14
4.1.0	4 / 21	2023-06-07
4.0.1	4 / 21	2023-04-15
4.0.0	4 / 21	2021-11-16
3.3.0	3 / 21	2023-06-14
3.2.0	3 / 21	2023-06-07
3.1.2	3 / 21	2023-04-15
3.1.1	3 / 21	2021-07-19
3.1.0	3 / 21	2021-07-05
3.0.0	3 / 21	2020-10-05
2.7.1	3 / 21	2020-08-31
2.7.0	3 / 21	2020-05-29
2.6.6	2 / 22	2020-04-17
2.6.5	2 / 24	2020-03-11
2.6.4	2 / 24	2020-01-17
2.6.3	2 / 24	2020-01-17
2.6.2	2 / 24	2020-01-14
2.6.1	2 / 24	2019-11-28
2.6.0	2 / 24	2019-11-27
2.5.0	2 / 23	2019-10-15
2.4.1	2 / 23	2019-09-27
2.4.0	2 / 23	2019-09-26
2.3.0	2 / 22	2019-09-26
2.2.0	2 / 22	2019-09-02
2.1.0	2 / 22	2019-08-07
2.0.1	2 / 22	2019-07-18
2.0.0	2 / 22	2019-07-17
1.0.0	3 / 10	2018-08-07
0.4.7	2 / 10	2018-08-07
0.4.6	2 / 10	2018-08-06
0.4.5	2 / 25	2018-02-13
0.4.4	2 / 25	2018-02-13
0.4.3	2 / 17	2017-12-14
0.4.2	3 / 17	2017-11-09
0.4.1	2 / 16	2017-11-03
0.4.0	2 / 16	2017-10-30
0.3.0	1 / 18	2017-04-29
0.2.1	1 / 21	2017-03-13
0.1.0	1 / 21	2017-03-07

v4.3.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v4.3.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v4.3.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v4.2.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v4.1.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v4.0.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v4.0.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v3.3.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.1.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.7.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.7.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.6.6

2 findings

HIGH Publisher changed: d3viant0ne → evilebottnawi (on 2020-04-17) provenance

This version was published by a different npm account than previous versions on 2020-04-17. This could indicate a legitimate maintainer transition or an account compromise.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.6.5

2 findings

HIGH Publisher changed: d3viant0ne → evilebottnawi (on 2020-03-11) provenance

This version was published by a different npm account than previous versions on 2020-03-11. This could indicate a legitimate maintainer transition or an account compromise.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.6.4

2 findings

HIGH Publisher changed: d3viant0ne → evilebottnawi (on 2020-01-17) provenance

This version was published by a different npm account than previous versions on 2020-01-17. This could indicate a legitimate maintainer transition or an account compromise.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.6.3

2 findings

HIGH Publisher changed: d3viant0ne → evilebottnawi (on 2020-01-17) provenance

This version was published by a different npm account than previous versions on 2020-01-17. This could indicate a legitimate maintainer transition or an account compromise.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.6.2

2 findings

HIGH Publisher changed: d3viant0ne → evilebottnawi (on 2020-01-14) provenance

This version was published by a different npm account than previous versions on 2020-01-14. This could indicate a legitimate maintainer transition or an account compromise.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.6.1

2 findings

HIGH Publisher changed: d3viant0ne → evilebottnawi (on 2019-11-28) provenance

This version was published by a different npm account than previous versions on 2019-11-28. This could indicate a legitimate maintainer transition or an account compromise.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.6.0

2 findings

HIGH Publisher changed: d3viant0ne → evilebottnawi (on 2019-11-27) provenance

This version was published by a different npm account than previous versions on 2019-11-27. This could indicate a legitimate maintainer transition or an account compromise.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.5.0

2 findings

HIGH Publisher changed: d3viant0ne → evilebottnawi (on 2019-10-15) provenance

This version was published by a different npm account than previous versions on 2019-10-15. This could indicate a legitimate maintainer transition or an account compromise.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.4.1

2 findings

HIGH Publisher changed: d3viant0ne → evilebottnawi (on 2019-09-27) provenance

This version was published by a different npm account than previous versions on 2019-09-27. This could indicate a legitimate maintainer transition or an account compromise.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.4.0

2 findings

HIGH Publisher changed: d3viant0ne → evilebottnawi (on 2019-09-26) provenance

This version was published by a different npm account than previous versions on 2019-09-26. This could indicate a legitimate maintainer transition or an account compromise.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.3.0

2 findings

HIGH Publisher changed: d3viant0ne → evilebottnawi (on 2019-09-26) provenance

This version was published by a different npm account than previous versions on 2019-09-26. This could indicate a legitimate maintainer transition or an account compromise.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.2.0

2 findings

HIGH Publisher changed: d3viant0ne → evilebottnawi (on 2019-09-02) provenance

This version was published by a different npm account than previous versions on 2019-09-02. This could indicate a legitimate maintainer transition or an account compromise.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.1.0

2 findings

HIGH Publisher changed: d3viant0ne → evilebottnawi (on 2019-08-07) provenance

This version was published by a different npm account than previous versions on 2019-08-07. This could indicate a legitimate maintainer transition or an account compromise.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.0.1

2 findings

HIGH Publisher changed: d3viant0ne → evilebottnawi (on 2019-07-18) provenance

This version was published by a different npm account than previous versions on 2019-07-18. This could indicate a legitimate maintainer transition or an account compromise.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.0.0

2 findings

HIGH Publisher changed: d3viant0ne → evilebottnawi (on 2019-07-17) provenance

This version was published by a different npm account than previous versions on 2019-07-17. This could indicate a legitimate maintainer transition or an account compromise.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.0.0

2 findings

HIGH Publisher changed: d3viant0ne → michael-ciniawsky (on 2018-08-07) provenance

This version was published by a different npm account than previous versions on 2018-08-07. This could indicate a legitimate maintainer transition or an account compromise.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.4.7

2 findings

HIGH Publisher changed: d3viant0ne → michael-ciniawsky (on 2018-08-07) provenance

This version was published by a different npm account than previous versions on 2018-08-07. This could indicate a legitimate maintainer transition or an account compromise.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.4.6

2 findings

HIGH Publisher changed: d3viant0ne → michael-ciniawsky (on 2018-08-06) provenance

This version was published by a different npm account than previous versions on 2018-08-06. This could indicate a legitimate maintainer transition or an account compromise.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.4.5

2 findings

HIGH Publisher changed: d3viant0ne → michael-ciniawsky (on 2018-02-13) provenance

This version was published by a different npm account than previous versions on 2018-02-13. This could indicate a legitimate maintainer transition or an account compromise.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.4.4

2 findings

HIGH Publisher changed: d3viant0ne → michael-ciniawsky (on 2018-02-13) provenance

This version was published by a different npm account than previous versions on 2018-02-13. This could indicate a legitimate maintainer transition or an account compromise.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.4.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.4.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.4.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.4.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.3.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.2.1

2 findings

HIGH Package has 'postinstall' script install-scripts

Script: node lib/post_install.js

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.1.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.