typhonjs-escomplex-module
Provides module / individual file oriented AST processing for typhonjs-escomplex complexity reports.
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| maintainer-change | maintainer-takeover | AI (maintainer-change): typhonrt is the same person as Mike Leahy (same GitHub org, same email domain, consistent authorship across all versions). This is an account consolidation, not a hostile takeover. | ai | |
| maintainer-change | maintainer-added | AI (maintainer-change): typhonrt is the legitimate author/maintainer of the typhonjs ecosystem; addition reflects account rename, not a new third party. | ai | |
| maintainer-change | maintainer-removed | AI (maintainer-change): mike leahy and typhonrt are the same individual; removal of the old account name is benign. | ai | |
| publish-pattern | new-deps-added | AI (publish-pattern): typhonjs-escomplex-commons is part of the same typhonjs ecosystem by the same author; not a foreign or suspicious dependency injection. | ai |
Versions (showing 12 of 12)
| Version | Deps | Published |
|---|---|---|
| 0.1.0 | 5 / 7 | |
| 0.0.12 | 5 / 6 | |
| 0.0.11 | 5 / 6 | |
| 0.0.10 | 5 / 6 | |
| 0.0.9 | 5 / 6 | |
| 0.0.7 | 5 / 6 | |
| 0.0.6 | 5 / 6 | |
| 0.0.5 | 5 / 6 | |
| 0.0.4 | 5 / 6 | |
| 0.0.3 | 5 / 6 | |
| 0.0.2 | 5 / 6 | |
| 0.0.1 | 4 / 6 |
v0.1.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.12
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.11
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.10
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.9
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.7
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.6
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.5
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.4
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.3
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.2
2 findingsAll previous maintainers (mike leahy) were replaced by new maintainers (typhonrt). This is a strong signal of a potential package hijack and requires careful review.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.