@ampproject/toolbox-core
Commonly used functionality for amp-toolbox
20
Versions
Apache-2.0
License
No
Install Scripts
Missing
Provenance
Supply chain provenance
Status for the latest visible version.
No SLSA provenance
npm registry signatures
gitHead linked
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
ampproject-adminkristoferbaxterjridgewellchoumxamp-toolboxfstaniserwinmombaysamouricaroqliursimhadvoytenkopatrickkettneralanorozcokdwanampprojectbotesth
Keywords
amp
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| maintainer-change | maintainer-added | AI (maintainer-change): Maintainer changes reflect normal team rotation within the official AMP Project org; publisher account and repo URL remain consistent with the ampproject GitHub org. | ai | |
| maintainer-change | maintainer-removed | AI (maintainer-change): Removal of prior maintainers is consistent with team rotation in the AMP Project; no signs of hostile takeover given stable publisher account and repo. | ai | |
| provenance | no-provenance | AI (provenance): Package predates Sigstore provenance; absence is expected for this era of publishing and not a risk indicator for this established package. | ai | |
| provenance | publisher-changed | AI (provenance): Publisher change from amp-toolbox to ampproject-admin reflects a legitimate AMP Project org account consolidation; ampproject-admin has a strong track record (109 approved, 0 rejected) and is the canonical AMP Project admin account. | ai |