traceur
ES6 to ES5 compiler
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | source-size-tripled | AI (source-diff): Size increase reflects bundling the compiled compiler and runtime into bin/ files, replacing the regexpu dep. Expected for a transpiler shipping self-contained binaries. | ai | |
| source-diff | obfuscated-file:bin/traceur.js | AI (source-diff): bin/traceur.js is Traceur's bundled/minified compiler output — standard practice for this transpiler tool. Long lines are from minification, not obfuscation. Stable for this package. | ai | |
| source-diff | obfuscated-file:dist/commonjs/outputgeneration/regexpuRewritePattern.js | AI (source-diff): This is a bundled/compiled version of the regexpu library in Traceur's dist/ output. Long lines are expected minified build artifacts for this transpiler project, not obfuscation. | ai | |
| publish-pattern | new-deps-added | AI (publish-pattern): source-map-support is a well-known, benign package; its addition is natural for a compiler/transpiler like Traceur. | ai | |
| semgrep | semgrep:new-function-constructor | AI (semgrep): Usage is in vendored Google Closure Library; the pattern is a trivial identity function (return a) — benign and stable across versions. | ai | |
| source-diff | source-size-dropped | AI (source-diff): Size drop is explained by the explicit 'files' whitelist in package.json scoping the publish to only src/node/*.js and bin/ files — a deliberate packaging optimization, not code replacement. | ai | |
| source-diff | obfuscated-file:bin/BrowserSystem.js | AI (source-diff): BrowserSystem.js is a legitimate minified browser bundle for the Traceur compiler runtime. Long lines are expected in bundled build artifacts for this transpiler package. | ai | |
| source-diff | net-exec-file:src/util/parseProlog.js | AI (source-diff): parseProlog.js is a legitimate compiler utility parsing comment directives in source files. The eval() evaluates skip-directive expressions from test files; the 'network' signal is a false positive from ES6 import statements, not actual network calls. | ai | |
| provenance | publisher-changed | AI (provenance): Publisher change johnjbarton→arv occurred in 2014; arv has 575 approved packages and is a known Google Traceur maintainer. Historical transition, not a compromise. | ai | |
| phantom-deps | phantom-dep:semver | AI (phantom-deps): semver is declared in both dependencies and devDependencies; phantom-dep finding is a false positive for this package's build/config usage pattern. | ai | |
| phantom-deps | phantom-dep:regexpu | AI (phantom-deps): regexpu is a legitimate runtime dependency for Unicode regex support in the transpiler; indirect usage via config is expected. | ai | |
| license | uncommon-license:Apache License 2.0 | AI (license): Apache License 2.0 is a standard permissive license used by Google projects; the 'uncommon' flag is a false positive for this well-known license string. | ai | |
| semgrep | semgrep:dynamic-require | AI (semgrep): Dynamic require is core functionality in traceur-runtime.js — it implements module resolution for transpiled ES6 code. Expected and stable for this compiler package. | ai | |
| provenance | no-provenance | AI (provenance): Established Google-authored package (4791 days old) with consistent publisher history; lack of Sigstore provenance is expected for this era of package. | ai | |
| semgrep | semgrep:eval-usage | AI (semgrep): eval() in parseProlog.js is used to evaluate prolog directives in source files being compiled — inherent to a JS compiler/transpiler's design. | ai |
Versions (showing 100 of 104)
| Version | Deps | Published |
|---|---|---|
| 0.0.111 | 5 / 14 | |
| 0.0.110 | 5 / 14 | |
| 0.0.109 | 5 / 14 | |
| 0.0.107 | 5 / 14 | |
| 0.0.106 | 5 / 14 | |
| 0.0.105 | 5 / 14 | |
| 0.0.104 | 5 / 14 | |
| 0.0.103 | 5 / 14 | |
| 0.0.102 | 5 / 14 | |
| 0.0.101 | 5 / 14 | |
| 0.0.100 | 5 / 14 | |
| 0.0.99 | 5 / 14 | |
| 0.0.98 | 5 / 14 | |
| 0.0.97 | 5 / 14 | |
| 0.0.96 | 5 / 14 | |
| 0.0.95 | 5 / 14 | |
| 0.0.94 | 5 / 14 | |
| 0.0.93 | 5 / 14 | |
| 0.0.92 | 5 / 11 | |
| 0.0.91 | 5 / 11 | |
| 0.0.90 | 5 / 11 | |
| 0.0.89 | 5 / 11 | |
| 0.0.88 | 5 / 11 | |
| 0.0.87 | 5 / 11 | |
| 0.0.86 | 5 / 11 | |
| 0.0.85 | 5 / 10 | |
| 0.0.84 | 5 / 10 | |
| 0.0.83 | 5 / 10 | |
| 0.0.82 | 5 / 10 | |
| 0.0.81 | 5 / 10 | |
| 0.0.80 | 5 / 10 | |
| 0.0.79 | 5 / 11 | |
| 0.0.78 | 6 / 10 | |
| 0.0.77 | 6 / 10 | |
| 0.0.76 | 6 / 10 | |
| 0.0.74 | 6 / 13 | |
| 0.0.73 | 5 / 13 | |
| 0.0.72 | 5 / 13 | |
| 0.0.68 | 5 / 13 | |
| 0.0.67 | 5 / 13 | |
| 0.0.66 | 5 / 13 | |
| 0.0.65 | 5 / 13 | |
| 0.0.64 | 5 / 13 | |
| 0.0.62 | 5 / 13 | |
| 0.0.61 | 5 / 13 | |
| 0.0.60 | 4 / 13 | |
| 0.0.59 | 3 / 14 | |
| 0.0.58 | 3 / 14 | |
| 0.0.57 | 3 / 14 | |
| 0.0.56 | 3 / 14 | |
| 0.0.55 | 3 / 14 | |
| 0.0.54 | 3 / 14 | |
| 0.0.53 | 3 / 14 | |
| 0.0.52 | 3 / 14 | |
| 0.0.51 | 3 / 14 | |
| 0.0.50 | 3 / 12 | |
| 0.0.49 | 3 / 9 | |
| 0.0.48 | 3 / 9 | |
| 0.0.47 | 3 / 9 | |
| 0.0.46 | 3 / 9 | |
| 0.0.45 | 3 / 9 | |
| 0.0.44 | 3 / 9 | |
| 0.0.43 | 3 / 9 | |
| 0.0.42 | 3 / 9 | |
| 0.0.41 | 3 / 9 | |
| 0.0.40 | 3 / 9 | |
| 0.0.39 | 3 / 9 | |
| 0.0.38 | 3 / 9 | |
| 0.0.37 | 3 / 9 | |
| 0.0.36 | 3 / 9 | |
| 0.0.35 | 3 / 9 | |
| 0.0.34 | 3 / 9 | |
| 0.0.33 | 3 / 9 | |
| 0.0.32 | 3 / 8 | |
| 0.0.31 | 3 / 8 | |
| 0.0.30 | 3 / 8 | |
| 0.0.29 | 3 / 8 | |
| 0.0.28 | 3 / 8 | |
| 0.0.27 | 3 / 8 | |
| 0.0.25 | 3 / 8 | |
| 0.0.24 | 3 / 8 | |
| 0.0.23 | 3 / 8 | |
| 0.0.22 | 3 / 8 | |
| 0.0.21 | 3 / 8 | |
| 0.0.20 | 3 / 8 | |
| 0.0.19 | 3 / 8 | |
| 0.0.18 | 3 / 8 | |
| 0.0.17 | 3 / 8 | |
| 0.0.16 | 3 / 8 | |
| 0.0.15 | 3 / 8 | |
| 0.0.14 | 3 / 8 | |
| 0.0.13 | 3 / 8 | |
| 0.0.12 | 3 / 8 | |
| 0.0.11 | 3 / 8 | |
| 0.0.10 | 2 / 8 | |
| 0.0.9 | 2 / 6 | |
| 0.0.8 | 1 / 5 | |
| 0.0.7 | 1 / 4 | |
| 0.0.6 | 1 / 4 | |
| 0.0.5 | 1 / 3 |
v0.0.111
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.110
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.109
2 findingsNewly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.107
3 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2016-04-10. This could indicate a legitimate maintainer transition or an account compromise.
v0.0.106
2 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2016-04-07. This could indicate a legitimate maintainer transition or an account compromise.
v0.0.105
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.104
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.103
2 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2016-03-03. This could indicate a legitimate maintainer transition or an account compromise.
v0.0.102
2 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.101
2 findingsThis version was published by a different npm account than previous versions on 2016-01-29. This could indicate a legitimate maintainer transition or an account compromise.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.100
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.99
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.98
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.97
3 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2016-01-28. This could indicate a legitimate maintainer transition or an account compromise.
v0.0.96
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.95
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.94
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.93
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.92
2 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2015-10-14. This could indicate a legitimate maintainer transition or an account compromise.
v0.0.91
2 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2015-07-19. This could indicate a legitimate maintainer transition or an account compromise.
v0.0.90
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.89
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.88
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.87
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.86
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.85
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.84
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.83
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.82
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.81
2 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2015-01-12. This could indicate a legitimate maintainer transition or an account compromise.
v0.0.80
2 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2015-01-12. This could indicate a legitimate maintainer transition or an account compromise.
v0.0.79
3 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2014-12-03. This could indicate a legitimate maintainer transition or an account compromise.
v0.0.78
2 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.77
2 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.76
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.74
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: arv.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.73
2 findingsThis version was published by a different npm account than previous versions on 2014-11-04. This could indicate a legitimate maintainer transition or an account compromise.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.72
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: johnjbarton.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.68
3 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: johnjbarton.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2014-10-16. This could indicate a legitimate maintainer transition or an account compromise.
v0.0.67
2 findingsThis version was published by a different npm account than previous versions on 2014-10-14. This could indicate a legitimate maintainer transition or an account compromise.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.66
2 findingsThis version was published by a different npm account than previous versions on 2014-09-24. This could indicate a legitimate maintainer transition or an account compromise.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.65
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: johnjbarton.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.64
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: johnjbarton.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.62
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: johnjbarton.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.61
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.60
2 findingsThis version was published by a different npm account than previous versions on 2014-09-03. This could indicate a legitimate maintainer transition or an account compromise.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.59
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: johnjbarton.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.58
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.57
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.0.56
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.0.55
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.0.54
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.0.53
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.0.52
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.0.51
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.0.50
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.0.49
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.0.48
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.0.47
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.0.46
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.0.45
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.0.44
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.0.43
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.0.42
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.0.41
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.0.40
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.0.39
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.0.38
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.0.37
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.0.36
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.0.35
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.0.34
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.0.33
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.0.32
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.0.31
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.0.30
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.0.29
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.0.28
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.0.27
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.0.25
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.0.24
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.0.23
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.0.22
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.0.21
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.0.20
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.0.19
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.0.18
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.0.17
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.0.16
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.0.15
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.0.14
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.0.13
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.0.12
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.0.11
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.0.10
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.0.9
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.0.8
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.0.7
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.0.6
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.0.5
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.