@algolia/transporter
63
Versions
—
License
No
Install Scripts
Missing
Provenance
Supply chain provenance
Status for the latest visible version.
No SLSA provenance
npm registry signatures
No source commit
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
haroenvshortcutseric-zahariafluf
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| provenance | publisher-changed | AI (provenance): Publisher change reflects a legitimate Algolia org-level maintainer rotation; eric-zaharia has 213 approved packages across the Algolia ecosystem, consistent with an internal team transition. | ai | |
| maintainer-change | maintainer-added | AI (maintainer-change): New maintainers eric-zaharia and fluf are part of an Algolia org-wide rotation, not an isolated package takeover. eric-zaharia has a strong track record of 213 approved packages. | ai | |
| maintainer-change | maintainer-removed | AI (maintainer-change): Removal of millotp is consistent with the same org-level maintainer rotation across Algolia packages, not indicative of a hostile takeover. | ai | |
| dependencies | unvetted-dep:@algolia/cache-common | AI (dependencies): First-party Algolia sibling package from the same monorepo, always released at the same pinned version. Not a third-party risk. | ai | |
| provenance | no-provenance | AI (provenance): Algolia JS client monorepo does not use Sigstore provenance; absence is consistent across all versions and not a security concern for this well-established package. | ai | |
| dependencies | unvetted-dep:@algolia/logger-common | AI (dependencies): First-party Algolia sibling package from the same monorepo, always released at the same pinned version. Not a third-party risk. | ai | |
| dependencies | unvetted-dep:@algolia/requester-common | AI (dependencies): First-party Algolia sibling package from the same monorepo, always released at the same pinned version. Not a third-party risk. | ai |
Versions (showing 63 of 63)
| Version | Deps | Published |
|---|---|---|
| 4.27.0 | 3 / 0 | |
| 4.26.0 | 3 / 0 | |
| 4.25.3 | 3 / 0 | |
| 4.25.2 | 3 / 0 | |
| 4.25.1 | 3 / 0 | |
| 4.25.0 | 3 / 0 | |
| 4.24.0 | 3 / 0 | |
| 4.23.3 | 3 / 0 | |
| 4.23.2 | 3 / 0 | |
| 4.23.1 | 3 / 0 | |
| 4.23.0 | 3 / 0 | |
| 4.22.1 | 3 / 0 | |
| 4.22.0 | 3 / 0 | |
| 4.21.1 | 3 / 0 | |
| 4.21.0 | 3 / 0 | |
| 4.20.0 | 3 / 0 | |
| 4.19.1 | 3 / 0 | |
| 4.19.0 | 3 / 0 | |
| 4.18.0 | 3 / 0 | |
| 4.17.2 | 3 / 0 | |
| 4.17.1 | 3 / 0 | |
| 4.17.0 | 3 / 0 | |
| 4.16.0 | 3 / 0 | |
| 4.15.0 | 3 / 0 | |
| 4.14.3 | 3 / 0 | |
| 4.14.2 | 3 / 0 | |
| 4.14.1 | 3 / 0 | |
| 4.14.0 | 3 / 0 | |
| 4.13.1 | 3 / 0 | |
| 4.13.0 | 3 / 0 | |
| 4.12.2 | 3 / 0 | |
| 4.12.1 | 3 / 0 | |
| 4.12.0 | 3 / 0 | |
| 4.11.0 | 3 / 0 | |
| 4.10.5 | 3 / 0 | |
| 4.10.4 | 3 / 0 | |
| 4.10.3 | 3 / 0 | |
| 4.10.2 | 3 / 0 | |
| 4.10.0 | 3 / 0 | |
| 4.9.3 | 3 / 0 | |
| 4.9.2 | 3 / 0 | |
| 4.9.1 | 3 / 0 | |
| 4.9.0 | 3 / 0 | |
| 4.8.6 | 3 / 0 | |
| 4.8.5 | 3 / 0 | |
| 4.8.4 | 3 / 0 | |
| 4.8.3 | 3 / 0 | |
| 4.8.2 | 3 / 0 | |
| 4.8.1 | 3 / 0 | |
| 4.8.0 | 3 / 0 | |
| 4.7.0 | 3 / 0 | |
| 4.6.0 | 3 / 0 | |
| 4.5.1 | 3 / 0 | |
| 4.5.0 | 3 / 0 | |
| 4.4.0 | 3 / 0 | |
| 4.3.1 | 3 / 0 | |
| 4.3.0 | 3 / 0 | |
| 4.2.0 | 3 / 0 | |
| 4.1.0 | 3 / 0 | |
| 4.0.3 | 3 / 0 | |
| 4.0.2 | 3 / 0 | |
| 4.0.1 | 3 / 0 | |
| 4.0.0 | 3 / 0 |