@altimateai/altimate-core
21
Versions
—
License
No
Install Scripts
Missing
Provenance
Supply chain provenance
Status for the latest visible version.
No SLSA provenance
npm registry signatures
gitHead linked
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
mdesmet_altimatesarav.altimateanandgupta1
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | obfuscated-file:index.d.ts | AI (source-diff): index.d.ts is generated by napi-rs --dts-header flag, producing long single-line type definitions. Content is readable TypeScript interfaces, not obfuscated malicious code. Stable false positive for this napi-rs package. | ai | |
| semgrep | semgrep:child-process-import | AI (semgrep): napi-rs loader uses child_process only to run hardcoded 'ldd --version' for musl detection; no user-controlled input, stable pattern across all versions. | ai | |
| semgrep | semgrep:child-process-execsync | AI (semgrep): execSync('ldd --version') is a hardcoded napi-rs musl-detection idiom; not an arbitrary command execution risk for this package. | ai | |
| semgrep | semgrep:dynamic-require | AI (semgrep): Dynamic require on NAPI_RS_NATIVE_LIBRARY_PATH is a documented napi-rs override mechanism; stable false positive for this native binding package. | ai |
Versions (showing 21 of 21)
| Version | Deps | Published |
|---|---|---|
| 0.7.0 | 0 / 1 | |
| 0.6.0 | 0 / 1 | |
| 0.5.1 | 0 / 1 | |
| 0.5.0 | 0 / 1 | |
| 0.4.0 | 0 / 1 | |
| 0.3.1 | 0 / 1 | |
| 0.3.0 | 0 / 1 | |
| 0.2.6 | 0 / 1 | |
| 0.2.5 | 0 / 1 | |
| 0.2.4 | 0 / 1 | |
| 0.2.3 | 0 / 1 | |
| 0.2.2 | 0 / 1 | |
| 0.2.1 | 0 / 1 | |
| 0.2.0 | 0 / 1 | |
| 0.1.6 | 0 / 1 | |
| 0.1.5 | 0 / 1 | |
| 0.1.4 | 0 / 1 | |
| 0.1.3 | 0 / 1 | |
| 0.1.2 | 0 / 1 | |
| 0.1.1 | 0 / 1 | |
| 0.1.0 | 0 / 1 |