@ampproject/toolbox-optimizer
Server-side rendering for AMPs.
34
Versions
Apache-2.0
License
No
Install Scripts
Missing
Provenance
Supply chain provenance
Status for the latest visible version.
No SLSA provenance
npm registry signatures
gitHead linked
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
ampproject-adminkristoferbaxterjridgewellchoumxamp-toolboxfstaniserwinmombaysamouricaroqliursimhadvoytenkopatrickkettneralanorozcokdwanampprojectbotesth
Keywords
amp
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| provenance | no-provenance | AI (provenance): Trusted ampproject publisher with 130 approved packages; lack of Sigstore provenance is not a meaningful risk signal for this package. | ai | |
| publish-pattern | new-deps-added | AI (publish-pattern): cssnano replaced by cssnano-simple (lighter variant) and https-proxy-agent added for proxy support — both legitimate, well-known packages for an optimizer tool. | ai | |
| maintainer-change | maintainer-added | AI (maintainer-change): AMP Project is a large OSS initiative; maintainer additions are routine team growth. Publisher account has 123 approved / 0 rejected packages. | ai | |
| provenance | publisher-changed | AI (provenance): Publisher change from amp-toolbox to ampproject-admin reflects a legitimate org-level account consolidation; ampproject-admin has a clean track record and the repo URL remains the official ampproject GitHub org. | ai | |
| install-scripts | install-script:postinstall | AI (install-scripts): Postinstall runs 'node lib/warmup.js', a benign warmup step present across many versions of this established AMP Project package. Not a new addition. | ai | |
| phantom-deps | phantom-dep:abort-controller | AI (phantom-deps): abort-controller is explicitly declared in package.json dependencies; used indirectly/via config rather than direct import. Legitimate declared dependency. | ai | |
| semgrep | semgrep:dynamic-require | AI (semgrep): Dynamic require loads from a fixed local subdirectory (./transformers/) based on config-supplied transformer names. This is a standard plugin-loading pattern in a build tool, not an arbitrary code execution risk. | ai | |
| phantom-deps | phantom-dep:https-proxy-agent | AI (phantom-deps): https-proxy-agent is explicitly declared in package.json dependencies; used indirectly/via config rather than direct import. Legitimate declared dependency. | ai |
Versions (showing 34 of 34)
| Version | Deps | Published |
|---|---|---|
| 2.10.1 | 17 / 0 | |
| 2.10.0 | 17 / 0 | |
| 2.9.0 | 17 / 0 | |
| 2.8.10 | 17 / 0 | |
| 2.8.9 | 17 / 0 | |
| 2.8.8 | 17 / 0 | |
| 2.8.7 | 17 / 0 | |
| 2.8.6 | 18 / 0 | |
| 2.8.5 | 17 / 0 | |
| 2.8.4 | 17 / 0 | |
| 2.8.3 | 17 / 0 | |
| 2.8.2 | 17 / 0 | |
| 2.8.1 | 17 / 0 | |
| 2.8.0 | 17 / 0 | |
| 2.7.1 | 18 / 0 | |
| 2.6.0 | 18 / 0 | |
| 2.5.12 | 17 / 0 | |
| 2.5.11 | 17 / 0 | |
| 2.5.9 | 17 / 0 | |
| 2.5.8 | 17 / 0 | |
| 2.5.7 | 17 / 0 | |
| 2.5.6 | 17 / 0 | |
| 2.5.0 | 15 / 0 | |
| 2.3.1 | 11 / 0 | |
| 2.3.0 | 11 / 0 | |
| 2.2.0 | 11 / 0 | |
| 2.1.0 | 10 / 0 | |
| 2.0.1 | 10 / 0 | |
| 2.0.0 | 10 / 0 | |
| 1.1.2 | 6 / 0 | |
| 1.1.1 | 6 / 0 | |
| 1.1.0 | 6 / 0 | |
| 1.0.1 | 5 / 0 | |
| 1.0.0 | 5 / 0 |