← Home

@amplitude/analytics-core

npm Repository Homepage
100
Versions
—
License
No
Install Scripts
Verified
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures No source commit

Maintainers

curtisbliukelson.warnersdk.deveric_amplitudedaniel-graham-amplitudejjwang123

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
maintainer-change maintainer-removed AI (maintainer-change): Paired with maintainer-added; consistent with org team change, not a takeover. ai
maintainer-change maintainer-added AI (maintainer-change): Amplitude org rotation; SLSA provenance and no code changes confirm legitimate handoff. ai
provenance publisher-changed AI (provenance): Amplitude migrated to GitHub Actions publishing with SLSA attestation; this is expected for all future versions. ai
dependencies unvetted-dep:zen-observable AI (dependencies): zen-observable is a well-known, benign observable library; stable dependency for this package. ai
provenance missing-githead AI (provenance): SLSA provenance attestation present; gitHead absence is a minor metadata gap, not a supply-chain risk for this package. ai
provenance slsa-provenance AI (provenance): Amplitude consistently publishes via CI with SLSA attestation; stable pattern for this package. ai
bogus-package bogus-package AI (bogus-package): Amplitude SDK core package; sparse README/no keywords is a style choice, not a spam indicator for this established org. ai
phantom-deps phantom-dep:@types/zen-observable AI (phantom-deps): @types packages are often declared as runtime deps for type resolution; stable false positive for this package. ai

Versions (showing 100 of 111)

Version Deps Published
2.52.0 5 / 1
2.49.0 5 / 1
2.48.2 5 / 1
2.48.1 5 / 1
2.48.0 5 / 1
2.47.1 5 / 1
2.47.0 5 / 1
2.46.0 5 / 1
2.45.0 5 / 1
2.44.1 5 / 1
2.44.0 5 / 1
2.43.1 5 / 1
2.43.0 5 / 1
2.42.0 5 / 1
2.41.7 5 / 1
2.41.6 5 / 1
2.41.5 5 / 1
2.41.4 5 / 1
2.41.3 5 / 1
2.41.2 4 / 1
2.41.1 4 / 1
2.41.0 4 / 1
2.40.2 4 / 1
2.40.1 4 / 1
2.40.0 4 / 1
2.39.0 3 / 0
2.38.0 3 / 0
2.37.0 3 / 0
2.36.1 3 / 0
2.36.0 3 / 0
2.35.2 3 / 0
2.35.1 3 / 0
2.35.0 3 / 0
2.34.1 3 / 0
2.34.0 3 / 0
2.33.0 3 / 0
2.32.2 2 / 0
2.32.1 2 / 0
2.32.0 2 / 0
2.31.1 2 / 0
2.31.0 2 / 0
2.30.0 2 / 0
2.29.0 2 / 0
2.28.0 2 / 0
2.27.2 2 / 0
2.27.1 2 / 0
2.27.0 2 / 0
2.26.2 2 / 0
2.26.1 2 / 0
2.26.0 2 / 0
2.25.0 2 / 0
2.24.1 2 / 0
2.24.0 2 / 0
2.23.0 2 / 0
2.22.1 2 / 0
2.22.0 2 / 0
2.21.2 2 / 0
2.21.1 2 / 0
2.21.0 2 / 0
2.20.2 2 / 0
2.20.1 2 / 0
2.20.0 2 / 0
2.19.0 2 / 0
2.18.0 2 / 0
2.17.0 2 / 0
2.16.0 2 / 0
2.15.0 2 / 0
2.14.0 2 / 0
2.13.0 2 / 0
2.12.3 2 / 0
2.12.2 2 / 0
2.12.0 2 / 0
2.11.2 2 / 0
2.11.1 2 / 0
2.11.0 2 / 0
2.10.1 2 / 0
2.10.0 1 / 0
2.9.0 1 / 0
2.8.1 1 / 0
2.8.0 1 / 0
2.7.0 1 / 0
2.6.1 1 / 0
2.6.0 1 / 0
2.5.6 2 / 0
2.5.5 2 / 0
2.5.4 2 / 0
2.5.3 2 / 0
2.5.2 2 / 0
2.5.1 2 / 0
2.5.0 2 / 0
2.4.0 2 / 0
2.3.0 2 / 0
2.2.8 2 / 0
2.2.7 2 / 0
2.2.6 2 / 0
2.2.5 2 / 0
2.2.4 2 / 0
2.2.3 2 / 0
2.2.2 2 / 0
2.2.1 2 / 0
Showing 100 of 111 Next page →

v2.52.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v2.10.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.10.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.9.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.8.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.8.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.7.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.6.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.6.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.5.6

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.5.5

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.5.4

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.5.3

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.5.2

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.5.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.5.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.4.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.3.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.2.8

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.2.7

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.2.6

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.2.5

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.2.4

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.2.3

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.2.2

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.2.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.