ts-essentials — Greenflagged

All essential TypeScript types in one place

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures gitHead linked

Maintainers

krzkaczorberalivts-essentials-bot

Keywords

typescripttypesessentialsutilstoolboxtoolbeltlodashunderscore

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
source-diff	obfuscated-file:dist/is-exact/index.js	AI (source-diff): Standard tsc compiler output with inline base64 source map. This is normal for TypeScript type library dist files, not obfuscation.	ai	2026/04/27
provenance	publisher-changed	AI (provenance): ts-essentials-bot is the project's established CI publishing bot (1388 days, 64 approved). Transition from krzkaczor is legitimate.	ai	2026/04/24
maintainer-change	maintainer-added	AI (maintainer-change): beraliv and ts-essentials-bot are known contributors/bots for this project; legitimate team expansion.	ai	2026/04/24
source-diff	obfuscated-file:dist/literal-types/index.js	AI (source-diff): Standard tsc output with inline base64 source map; not obfuscation. Stable pattern for this types-only package.	ai	2026/04/24
source-diff	large-new-source-files	AI (source-diff): Types-only library with many individual type modules; per-module dist files are expected from tsc compilation.	ai	2026/04/24
source-diff	obfuscated-file:dist/deep-pick/index.js	AI (source-diff): Standard tsc output with inline sourcemap; type-only module compiles to empty JS + base64 sourcemap. Not obfuscated.	ai	2026/04/24
source-diff	obfuscated-file:dist/deep-omit/index.js	AI (source-diff): Standard tsc output with inline sourcemap; type-only module compiles to empty JS + base64 sourcemap. Not obfuscated.	ai	2026/04/24
source-diff	obfuscated-file:dist/camel-case/index.js	AI (source-diff): Standard tsc output with inline sourcemap; type-only module compiles to empty JS + base64 sourcemap. Not obfuscated.	ai	2026/04/24

Versions (showing 62 of 62)

Version	Deps	Published
10.2.0	0 / 10	2026-04-26
10.1.1	0 / 12	2025-06-12
10.1.0	0 / 12	2025-06-08
10.0.4	0 / 13	2024-12-26
10.0.3	0 / 10	2024-11-01
10.0.2	0 / 9	2024-08-13
10.0.1	0 / 9	2024-06-19
10.0.0	0 / 7	2024-05-01
9.4.2	0 / 7	2024-04-06
9.4.1	0 / 7	2023-10-05
9.4.0	0 / 7	2023-08-27
9.3.2	0 / 7	2023-05-02
9.3.1	0 / 7	2023-03-01
9.3.0	0 / 7	2022-08-23
9.2.0	0 / 7	2022-07-06
9.1.2	0 / 7	2021-12-30
9.1.0	0 / 7	2021-12-22
9.0.0	0 / 7	2021-09-29
8.1.0	0 / 7	2021-08-28
8.0.0	0 / 7	2021-08-16
7.0.3	0 / 7	2021-07-31
7.0.2	0 / 6	2021-06-08
7.0.1	0 / 5	2020-10-17
7.0.0	0 / 5	2020-06-20
6.0.7	0 / 5	2020-06-15
6.0.6	0 / 5	2020-06-15
6.0.5	0 / 5	2020-05-13
6.0.4	0 / 5	2020-03-31
6.0.3	0 / 5	2020-03-29
6.0.2	0 / 5	2020-02-28
6.0.1	0 / 5	2020-02-11
6.0.0	0 / 5	2020-02-05
5.0.0	0 / 5	2020-01-20
4.0.0	0 / 5	2019-12-10
3.0.5	0 / 5	2019-11-21
3.0.4	0 / 5	2019-11-03
3.0.3	0 / 5	2019-10-28
3.0.2	0 / 5	2019-08-16
3.0.1	0 / 5	2019-08-07
3.0.0	0 / 5	2019-07-12
2.0.12	0 / 5	2019-07-04
2.0.11	0 / 5	2019-06-24
2.0.10	0 / 5	2019-06-16
2.0.9	0 / 5	2019-06-16
2.0.8	0 / 5	2019-06-11
2.0.7	0 / 5	2019-05-04
2.0.6	0 / 5	2019-04-25
2.0.5	0 / 5	2019-04-18
2.0.4	0 / 5	2019-04-14
2.0.3	0 / 3	2019-03-07
2.0.2	0 / 3	2019-02-27
2.0.1	0 / 3	2019-02-26
2.0.0	0 / 3	2019-02-07
1.0.4	0 / 3	2019-01-29
1.0.3	0 / 2	2019-01-26
1.0.2	0 / 2	2018-12-20
1.0.1	0 / 2	2018-12-15
1.0.0	0 / 1	2018-09-23
0.0.5	0 / 1	2018-09-23
0.0.4	0 / 1	2018-09-23
0.0.3	0 / 1	2018-09-23
0.0.2	0 / 1	2018-09-23

v10.2.0

3 findings

HIGH New obfuscated file: dist/is-exact/index.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

INFO Publisher changed: ts-essentials-bot → GitHub Actions (on 2026-04-26) provenance

[Accepted risk] This version was published by a different npm account than previous versions on 2026-04-26. This could indicate a legitimate maintainer transition or an account compromise.

v10.1.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v10.0.4

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v10.0.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v10.0.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v10.0.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v10.0.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v9.4.2

4 findings

HIGH New obfuscated file: dist/camel-case/index.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/deep-omit/index.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/deep-pick/index.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v9.4.1

4 findings

HIGH New obfuscated file: dist/camel-case/index.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/deep-omit/index.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/deep-pick/index.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v9.4.0

4 findings

HIGH New obfuscated file: dist/camel-case/index.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/deep-omit/index.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/deep-pick/index.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v9.3.2

4 findings

HIGH New obfuscated file: dist/camel-case/index.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/deep-omit/index.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/deep-pick/index.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v9.3.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v9.3.0

3 findings

HIGH Publisher changed: krzkaczor → ts-essentials-bot (on 2022-08-23) provenance

This version was published by a different npm account than previous versions on 2022-08-23. This could indicate a legitimate maintainer transition or an account compromise.

HIGH New obfuscated file: dist/literal-types/index.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v9.2.0

3 findings

HIGH Publisher changed: krzkaczor → ts-essentials-bot (on 2022-07-06) provenance

This version was published by a different npm account than previous versions on 2022-07-06. This could indicate a legitimate maintainer transition or an account compromise.

HIGH New obfuscated file: dist/literal-types/index.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v9.1.2

2 findings

HIGH New obfuscated file: dist/literal-types/index.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v9.1.0

2 findings

HIGH New obfuscated file: dist/literal-types/index.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v9.0.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v8.1.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.