vega-lite
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| dependencies | unvetted-dep:vega-util | AI (dependencies): vega-util is a first-party Vega ecosystem package; a stable, expected dependency of vega-lite across all versions. | ai | |
| dependencies | unvetted-dep:vega-expression | AI (dependencies): vega-expression is a first-party Vega ecosystem package; a stable, expected dependency of vega-lite across all versions. | ai | |
| dependencies | unvetted-dep:vega-event-selector | AI (dependencies): vega-event-selector is a first-party Vega ecosystem package; a stable, expected dependency of vega-lite across all versions. | ai | |
| phantom-deps | phantom-dep:tslib | AI (phantom-deps): tslib is a standard TypeScript runtime helper; its implicit use pattern is well-known and benign for TypeScript-compiled packages. | ai | |
| phantom-deps | phantom-dep:json-stringify-pretty-compact | AI (phantom-deps): Declared in dependencies and referenced in config files; benign for this package's use case. | ai |
Versions (showing 7 of 7)
| Version | Deps | Published |
|---|---|---|
| 6.4.3 | 6 / 45 | |
| 6.4.2 | 6 / 43 | |
| 6.4.1 | 6 / 42 | |
| 6.4.0 | 6 / 42 | |
| 6.3.1 | 6 / 42 | |
| 6.3.0 | 6 / 42 | |
| 6.2.0 | 6 / 42 |
v6.4.3
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.4.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.4.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.4.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.3.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.3.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.2.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.