should
test framework agnostic BDD-style assertions
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| publish-pattern | new-deps-added | AI (publish-pattern): should-equal and should-format are first-party shouldjs org packages representing a documented modular refactor; not a supply-chain risk for this package. | ai | |
| source-diff | net-exec-file:es6/should.js | AI (source-diff): es6/should.js is a rollup-bundled ES6 build artifact generated by the package's own build scripts. The 'network + code execution' detection is a false positive on standard ES module imports and assertion library introspection patterns. | ai | |
| source-diff | net-exec-file:cjs/should.js | AI (source-diff): cjs/should.js is a rollup-bundled CJS build artifact generated by the package's own build scripts. The 'network + code execution' detection is a false positive on standard CommonJS require() calls and assertion library introspection patterns. | ai | |
| semgrep | semgrep:dynamic-require | AI (semgrep): Dynamic require in a browserify bundle artifact; not a runtime arbitrary module loader. Stable false positive for this package. | ai | |
| source-diff | net-exec-file:should.js | AI (source-diff): should.js is a standard browserify UMD bundle (browser build artifact). The detected 'network+exec' pattern is the browserify module loader boilerplate, not malware. Stable false positive for this package. | ai | |
| maintainer-change | maintainer-removed | AI (maintainer-change): Original maintainers (tjholowaychuk, gjohnson, travisjeffery) voluntarily transferred the package to btd in 2014. Removal is part of the legitimate handoff. | ai | |
| maintainer-change | maintainer-takeover | AI (maintainer-change): btd is the well-documented legitimate successor maintainer of should.js, taking over from TJ Holowaychuk in 2014. This is a historical, benign transfer, not a hijack. | ai | |
| source-diff | source-size-tripled | AI (source-diff): Size increase is explained by addition of a bundled browser build (should.js, 58KB), standard practice for this library's 3.x release. | ai | |
| provenance | publisher-changed | AI (provenance): Publisher change from tjholowaychuk to btd occurred in 2013 — a well-documented, decade-old legitimate maintainer transition for the should.js library. | ai | |
| maintainer-change | maintainer-added | AI (maintainer-change): New maintainers (gjohnson, travisjeffery, btd) were added as part of the same 2013 legitimate handoff; btd has a strong track record with 57 approved packages. | ai | |
| dependencies | unvetted-dep:should-type-adaptors | AI (dependencies): should-type-adaptors is a first-party sub-module of the shouldjs ecosystem, maintained by the same author. Not a third-party risk. | ai | |
| dependencies | unvetted-dep:should-type | AI (dependencies): should-type is a first-party sub-module of the shouldjs ecosystem, maintained by the same author. Not a third-party risk. | ai | |
| provenance | no-provenance | AI (provenance): Established package predating Sigstore provenance; no provenance is expected and not a risk signal here. | ai | |
| dependencies | unvetted-dep:should-equal | AI (dependencies): should-equal is a first-party sub-module of the shouldjs ecosystem, maintained by the same author. Not a third-party risk. | ai | |
| dependencies | unvetted-dep:should-format | AI (dependencies): should-format is a first-party sub-module of the shouldjs ecosystem, maintained by the same author. Not a third-party risk. | ai | |
| dependencies | unvetted-dep:should-util | AI (dependencies): should-util is a first-party sub-module of the shouldjs ecosystem, maintained by the same author. Not a third-party risk. | ai |
Versions (showing 100 of 113)
| Version | Deps | Published |
|---|---|---|
| 13.2.3 | 5 / 11 | |
| 13.2.2 | 5 / 11 | |
| 13.2.1 | 5 / 11 | |
| 13.2.0 | 5 / 11 | |
| 13.1.3 | 5 / 11 | |
| 13.1.2 | 5 / 11 | |
| 13.1.1 | 5 / 11 | |
| 13.1.0 | 5 / 11 | |
| 13.0.1 | 5 / 11 | |
| 13.0.0 | 5 / 11 | |
| 12.0.0 | 5 / 9 | |
| 11.2.1 | 5 / 8 | |
| 11.2.0 | 5 / 8 | |
| 11.1.2 | 5 / 8 | |
| 11.1.1 | 5 / 8 | |
| 11.1.0 | 5 / 8 | |
| 11.0.0 | 5 / 8 | |
| 10.0.0 | 3 / 7 | |
| 9.0.2 | 3 / 7 | |
| 9.0.1 | 3 / 7 | |
| 9.0.0 | 3 / 7 | |
| 8.4.0 | 3 / 15 | |
| 8.3.2 | 3 / 15 | |
| 8.3.1 | 3 / 15 | |
| 8.3.0 | 3 / 12 | |
| 8.2.2 | 3 / 12 | |
| 8.2.1 | 3 / 13 | |
| 8.2.0 | 3 / 13 | |
| 8.1.1 | 3 / 13 | |
| 8.1.0 | 3 / 13 | |
| 8.0.2 | 3 / 13 | |
| 8.0.1 | 3 / 13 | |
| 8.0.0 | 3 / 13 | |
| 7.1.1 | 3 / 11 | |
| 7.1.0 | 3 / 11 | |
| 7.0.4 | 3 / 11 | |
| 7.0.3 | 3 / 11 | |
| 7.0.2 | 3 / 11 | |
| 7.0.1 | 3 / 11 | |
| 7.0.0 | 3 / 11 | |
| 6.0.3 | 3 / 12 | |
| 6.0.2 | 3 / 12 | |
| 6.0.1 | 3 / 12 | |
| 6.0.0 | 3 / 12 | |
| 5.2.0 | 3 / 11 | |
| 5.1.0 | 3 / 11 | |
| 5.0.1 | 3 / 11 | |
| 5.0.0 | 3 / 11 | |
| 4.6.5 | 3 / 11 | |
| 4.6.4 | 3 / 11 | |
| 4.6.3 | 3 / 11 | |
| 4.6.2 | 3 / 11 | |
| 4.6.1 | 3 / 11 | |
| 4.6.0 | 2 / 11 | |
| 4.5.2 | 2 / 11 | |
| 4.5.1 | 2 / 11 | |
| 4.5.0 | 2 / 11 | |
| 4.4.4 | 2 / 11 | |
| 4.4.3 | 2 / 11 | |
| 4.4.2 | 2 / 11 | |
| 4.4.1 | 2 / 11 | |
| 4.4.0 | 2 / 11 | |
| 4.3.1 | 2 / 11 | |
| 4.3.0 | 2 / 11 | |
| 4.2.1 | 2 / 12 | |
| 4.2.0 | 2 / 12 | |
| 4.1.0 | 1 / 12 | |
| 4.0.4 | 0 / 12 | |
| 4.0.3 | 0 / 12 | |
| 4.0.1 | 0 / 12 | |
| 4.0.0 | 0 / 12 | |
| 3.3.2 | 0 / 5 | |
| 3.3.1 | 0 / 5 | |
| 3.3.0 | 0 / 5 | |
| 3.2.0 | 0 / 5 | |
| 3.1.4 | 0 / 5 | |
| 3.1.3 | 0 / 5 | |
| 3.1.2 | 0 / 3 | |
| 3.1.1 | 0 / 3 | |
| 3.1.0 | 0 / 3 | |
| 3.0.1 | 0 / 1 | |
| 3.0.0 | 0 / 1 | |
| 2.1.1 | 0 / 1 | |
| 2.1.0 | 0 / 1 | |
| 2.0.2 | 0 / 1 | |
| 2.0.1 | 0 / 1 | |
| 2.0.0 | 0 / 1 | |
| 1.3.0 | 0 / 1 | |
| 1.2.2 | 0 / 1 | |
| 1.2.1 | 0 / 1 | |
| 1.2.0 | 0 / 1 | |
| 1.1.1 | 0 / 1 | |
| 1.1.0 | 0 / 1 | |
| 1.0.0 | 0 / 1 | |
| 0.6.3 | 0 / 1 | |
| 0.6.2 | 0 / 1 | |
| 0.6.1 | 0 / 1 | |
| 0.6.0 | 0 / 2 | |
| 0.5.1 | 0 / 2 | |
| 0.5.0 | 0 / 2 |
v13.2.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v11.2.1
3 findingsNewly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v11.2.0
3 findingsNewly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v11.1.2
3 findingsNewly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v11.1.1
3 findingsNewly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v11.1.0
3 findingsNewly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v11.0.0
3 findingsNewly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v10.0.0
3 findingsNewly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.0.2
3 findingsNewly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.0.1
3 findingsNewly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.0.0
3 findingsNewly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v8.4.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v8.3.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v8.3.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v8.3.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v8.2.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v8.2.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v8.2.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v8.1.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v8.1.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v8.0.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v8.0.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v8.0.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v7.1.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v7.1.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v7.0.4
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v7.0.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v7.0.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v7.0.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v7.0.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v6.0.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v6.0.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v6.0.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v6.0.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.2.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.1.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.0.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.0.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.6.5
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.6.4
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.6.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.6.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.6.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.6.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.5.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.5.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.5.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.4.4
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.4.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.4.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.4.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.4.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.3.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.3.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.2.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.2.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.1.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.0.4
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.0.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.0.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.0.0
2 findingsThis version was published by a different npm account than previous versions on 2014-05-29. This could indicate a legitimate maintainer transition or an account compromise.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.3.2
2 findingsThis version was published by a different npm account than previous versions on 2014-05-23. This could indicate a legitimate maintainer transition or an account compromise.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.3.1
2 findingsThis version was published by a different npm account than previous versions on 2014-04-16. This could indicate a legitimate maintainer transition or an account compromise.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.3.0
2 findingsThis version was published by a different npm account than previous versions on 2014-04-07. This could indicate a legitimate maintainer transition or an account compromise.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.2.0
2 findingsThis version was published by a different npm account than previous versions on 2014-03-29. This could indicate a legitimate maintainer transition or an account compromise.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.1.4
2 findingsThis version was published by a different npm account than previous versions on 2014-03-18. This could indicate a legitimate maintainer transition or an account compromise.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.1.3
2 findingsThis version was published by a different npm account than previous versions on 2014-02-25. This could indicate a legitimate maintainer transition or an account compromise.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.1.2
3 findingsAll previous maintainers (tjholowaychuk, gjohnson, travisjeffery) were replaced by new maintainers (btd). This is a strong signal of a potential package hijack and requires careful review.
This version was published by a different npm account than previous versions on 2014-01-28. This could indicate a legitimate maintainer transition or an account compromise.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.1.1
3 findingsAll previous maintainers (tjholowaychuk, gjohnson, travisjeffery) were replaced by new maintainers (btd). This is a strong signal of a potential package hijack and requires careful review.
This version was published by a different npm account than previous versions on 2014-01-27. This could indicate a legitimate maintainer transition or an account compromise.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.1.0
3 findingsAll previous maintainers (tjholowaychuk, gjohnson, travisjeffery) were replaced by new maintainers (btd). This is a strong signal of a potential package hijack and requires careful review.
This version was published by a different npm account than previous versions on 2014-01-23. This could indicate a legitimate maintainer transition or an account compromise.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.0.1
2 findingsThis version was published by a different npm account than previous versions on 2014-01-17. This could indicate a legitimate maintainer transition or an account compromise.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.0.0
3 findingsAll previous maintainers (tjholowaychuk, gjohnson, travisjeffery) were replaced by new maintainers (btd). This is a strong signal of a potential package hijack and requires careful review.
This version was published by a different npm account than previous versions on 2014-01-17. This could indicate a legitimate maintainer transition or an account compromise.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.1.1
3 findingsThis version was published by a different npm account than previous versions on 2013-12-05. This could indicate a legitimate maintainer transition or an account compromise.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.1.0
3 findingsThis version was published by a different npm account than previous versions on 2013-11-11. This could indicate a legitimate maintainer transition or an account compromise.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.0.2
3 findingsThis version was published by a different npm account than previous versions on 2013-10-21. This could indicate a legitimate maintainer transition or an account compromise.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.0.1
2 findingsThis version was published by a different npm account than previous versions on 2013-10-10. This could indicate a legitimate maintainer transition or an account compromise.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.0.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.3.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.2.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.2.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.2.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.1.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.1.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.6.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.6.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.6.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.6.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.5.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.5.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.