← Home

@ampproject/toolbox-optimizer

Server-side rendering for AMPs.

34
Versions
Apache-2.0
License
No
Install Scripts
Missing
Provenance

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.

Maintainers

ampproject-adminkristoferbaxterjridgewellchoumxamp-toolboxfstaniserwinmombaysamouricaroqliursimhadvoytenkopatrickkettneralanorozcokdwanampprojectbotesth

Keywords

amp

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
provenance no-provenance AI (provenance): Trusted ampproject publisher with 130 approved packages; lack of Sigstore provenance is not a meaningful risk signal for this package. ai
publish-pattern new-deps-added AI (publish-pattern): cssnano replaced by cssnano-simple (lighter variant) and https-proxy-agent added for proxy support — both legitimate, well-known packages for an optimizer tool. ai
maintainer-change maintainer-added AI (maintainer-change): AMP Project is a large OSS initiative; maintainer additions are routine team growth. Publisher account has 123 approved / 0 rejected packages. ai
provenance publisher-changed AI (provenance): Publisher change from amp-toolbox to ampproject-admin reflects a legitimate org-level account consolidation; ampproject-admin has a clean track record and the repo URL remains the official ampproject GitHub org. ai
install-scripts install-script:postinstall AI (install-scripts): Postinstall runs 'node lib/warmup.js', a benign warmup step present across many versions of this established AMP Project package. Not a new addition. ai
phantom-deps phantom-dep:abort-controller AI (phantom-deps): abort-controller is explicitly declared in package.json dependencies; used indirectly/via config rather than direct import. Legitimate declared dependency. ai
semgrep semgrep:dynamic-require AI (semgrep): Dynamic require loads from a fixed local subdirectory (./transformers/) based on config-supplied transformer names. This is a standard plugin-loading pattern in a build tool, not an arbitrary code execution risk. ai
phantom-deps phantom-dep:https-proxy-agent AI (phantom-deps): https-proxy-agent is explicitly declared in package.json dependencies; used indirectly/via config rather than direct import. Legitimate declared dependency. ai

Versions (showing 34 of 34)

Version Deps Published
2.10.1 17 / 0
2.10.0 17 / 0
2.9.0 17 / 0
2.8.10 17 / 0
2.8.9 17 / 0
2.8.8 17 / 0
2.8.7 17 / 0
2.8.6 18 / 0
2.8.5 17 / 0
2.8.4 17 / 0
2.8.3 17 / 0
2.8.2 17 / 0
2.8.1 17 / 0
2.8.0 17 / 0
2.7.1 18 / 0
2.6.0 18 / 0
2.5.12 17 / 0
2.5.11 17 / 0
2.5.9 17 / 0
2.5.8 17 / 0
2.5.7 17 / 0
2.5.6 17 / 0
2.5.0 15 / 0
2.3.1 11 / 0
2.3.0 11 / 0
2.2.0 11 / 0
2.1.0 10 / 0
2.0.1 10 / 0
2.0.0 10 / 0
1.1.2 6 / 0
1.1.1 6 / 0
1.1.0 6 / 0
1.0.1 5 / 0
1.0.0 5 / 0