standard-engine
Wrap your standards in a tortilla and cover it in special sauce.
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| provenance | no-provenance | AI (provenance): Established package published by feross with strong track record; lack of provenance attestation is a known condition across all versions, not a new risk. | ai | |
| provenance | publisher-changed | AI (provenance): Documented transition from feross to voxpelli in the standard ecosystem. Voxpelli has strong npm track record (818 approved/0 rejected) and is a known contributor to the standard toolchain. | ai | |
| maintainer-change | maintainer-added | AI (maintainer-change): New maintainers (jhiesey, raynos, toddbluhm, voxpelli) are recognized contributors consistent with a legitimate team expansion for the standard-engine package. | ai |
Versions (showing 86 of 86)
| Version | Deps | Published |
|---|---|---|
| 15.1.0 | 4 / 22 | |
| 15.0.0 | 4 / 22 | |
| 14.0.1 | 4 / 11 | |
| 14.0.0 | 4 / 11 | |
| 13.0.0 | 5 / 13 | |
| 12.1.0 | 4 / 13 | |
| 12.0.1 | 4 / 13 | |
| 12.0.0 | 4 / 13 | |
| 11.0.1 | 4 / 13 | |
| 11.0.0 | 4 / 13 | |
| 10.0.0 | 4 / 13 | |
| 9.0.0 | 4 / 13 | |
| 8.0.1 | 4 / 13 | |
| 8.0.0 | 4 / 13 | |
| 7.2.0 | 4 / 15 | |
| 7.1.0 | 4 / 15 | |
| 7.0.0 | 4 / 15 | |
| 6.0.0 | 5 / 13 | |
| 5.4.0 | 5 / 13 | |
| 5.3.0 | 6 / 13 | |
| 5.2.0 | 6 / 13 | |
| 5.1.1 | 6 / 13 | |
| 5.1.0 | 6 / 13 | |
| 5.0.3 | 5 / 13 | |
| 5.0.2 | 8 / 13 | |
| 5.0.1 | 8 / 13 | |
| 5.0.0 | 8 / 13 | |
| 4.1.3 | 8 / 13 | |
| 4.1.2 | 8 / 13 | |
| 4.1.1 | 8 / 13 | |
| 4.1.0 | 8 / 13 | |
| 4.0.5 | 8 / 13 | |
| 4.0.4 | 8 / 13 | |
| 4.0.3 | 8 / 13 | |
| 4.0.2 | 8 / 13 | |
| 4.0.1 | 8 / 13 | |
| 4.0.0 | 8 / 13 | |
| 3.3.1 | 8 / 13 | |
| 3.3.0 | 8 / 13 | |
| 3.2.4 | 8 / 13 | |
| 3.2.3 | 8 / 13 | |
| 3.2.2 | 8 / 13 | |
| 3.2.1 | 8 / 13 | |
| 3.2.0 | 8 / 13 | |
| 3.1.1 | 8 / 12 | |
| 3.1.0 | 8 / 12 | |
| 3.0.1 | 8 / 12 | |
| 3.0.0 | 9 / 11 | |
| 2.2.5 | 10 / 9 | |
| 2.2.4 | 10 / 9 | |
| 2.2.3 | 10 / 9 | |
| 2.2.2 | 10 / 9 | |
| 2.2.1 | 10 / 9 | |
| 2.2.0 | 10 / 9 | |
| 2.1.1 | 10 / 9 | |
| 2.1.0 | 10 / 9 | |
| 2.0.7 | 10 / 8 | |
| 2.0.6 | 10 / 8 | |
| 2.0.5 | 10 / 8 | |
| 2.0.4 | 10 / 8 | |
| 2.0.3 | 10 / 8 | |
| 2.0.2 | 11 / 8 | |
| 2.0.1 | 11 / 8 | |
| 2.0.0 | 11 / 8 | |
| 1.11.1 | 9 / 7 | |
| 1.11.0 | 9 / 7 | |
| 1.10.2 | 9 / 7 | |
| 1.10.1 | 12 / 7 | |
| 1.10.0 | 12 / 7 | |
| 1.9.0 | 12 / 7 | |
| 1.8.1 | 12 / 8 | |
| 1.8.0 | 12 / 8 | |
| 1.7.0 | 11 / 6 | |
| 1.6.0 | 10 / 6 | |
| 1.5.0 | 10 / 6 | |
| 1.4.3 | 10 / 6 | |
| 1.4.2 | 12 / 5 | |
| 1.4.1 | 12 / 5 | |
| 1.4.0 | 11 / 6 | |
| 1.3.1 | 11 / 6 | |
| 1.3.0 | 11 / 6 | |
| 1.2.0 | 11 / 5 | |
| 1.1.0 | 11 / 5 | |
| 1.0.2 | 11 / 5 | |
| 1.0.1 | 11 / 5 | |
| 1.0.0 | 11 / 5 |
v15.1.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v15.0.0
2 findingsThis version was published by a different npm account than previous versions on 2022-04-20. This could indicate a legitimate maintainer transition or an account compromise.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v14.0.1
2 findingsMaintainer email '[email protected]' uses domain 'aoaioxxysz.net' which has no DNS records. An attacker could register this domain to hijack the maintainer identity.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v14.0.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.