← Home

@amplitude/analytics-core

npm Repository Homepage
11
Versions
—
License
No
Install Scripts
Verified
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures No source commit

Maintainers

curtisbliukelson.warnersdk.deveric_amplitudedaniel-graham-amplitudejjwang123

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
maintainer-change maintainer-removed AI (maintainer-change): Paired with maintainer-added; consistent with org team change, not a takeover. ai
maintainer-change maintainer-added AI (maintainer-change): Amplitude org rotation; SLSA provenance and no code changes confirm legitimate handoff. ai
provenance publisher-changed AI (provenance): Amplitude migrated to GitHub Actions publishing with SLSA attestation; this is expected for all future versions. ai
dependencies unvetted-dep:zen-observable AI (dependencies): zen-observable is a well-known, benign observable library; stable dependency for this package. ai
provenance missing-githead AI (provenance): SLSA provenance attestation present; gitHead absence is a minor metadata gap, not a supply-chain risk for this package. ai
provenance slsa-provenance AI (provenance): Amplitude consistently publishes via CI with SLSA attestation; stable pattern for this package. ai
bogus-package bogus-package AI (bogus-package): Amplitude SDK core package; sparse README/no keywords is a style choice, not a spam indicator for this established org. ai
phantom-deps phantom-dep:@types/zen-observable AI (phantom-deps): @types packages are often declared as runtime deps for type resolution; stable false positive for this package. ai

Versions (showing 11 of 111)

Version Deps Published
2.2.0 2 / 0
2.1.3 2 / 0
2.1.2 2 / 0
2.1.1 2 / 0
2.1.0 2 / 0
2.0.5 2 / 0
2.0.4 2 / 0
2.0.3 2 / 0
2.0.2 2 / 0
2.0.1 2 / 0
2.0.0 2 / 0

v2.2.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.1.3

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.1.2

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.1.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.1.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.0.5

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.0.4

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.0.3

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.0.2

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.0.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.0.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.