@antv/l7-maps
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | obfuscated-file:es/mapbox/map.js | AI (source-diff): Babel-transpiled output with inline CSS strings causing long lines; not obfuscated or malicious. | ai | |
| source-diff | obfuscated-file:es/maplibre/map.js | AI (source-diff): Babel-transpiled output with inline CSS strings causing long lines; not obfuscated or malicious. | ai | |
| source-diff | obfuscated-file:lib/mapbox/map.js | AI (source-diff): Babel-transpiled CJS output with inline CSS strings causing long lines; not obfuscated or malicious. | ai | |
| source-diff | obfuscated-file:lib/maplibre/map.js | AI (source-diff): Babel-transpiled CJS output with inline CSS strings causing long lines; not obfuscated or malicious. | ai | |
| provenance | no-provenance | AI (provenance): Established AntV monorepo package; no provenance is consistent across all versions. | ai | |
| phantom-deps | phantom-dep:pmtiles | AI (phantom-deps): Tile format dep referenced in config; expected for a maps package. | ai | |
| phantom-deps | phantom-dep:gl-matrix | AI (phantom-deps): Math utility referenced in config; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:eventemitter3 | AI (phantom-deps): Event utility referenced in config; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:@antv/l7-map | AI (phantom-deps): Same-org monorepo dep; phantom-dep heuristic is a stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:@amap/amap-jsapi-loader | AI (phantom-deps): AMap provider dep referenced in config; expected for a maps abstraction package. | ai | |
| phantom-deps | phantom-dep:viewport-mercator-project | AI (phantom-deps): Projection utility referenced in config; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:@babel/runtime | AI (phantom-deps): Framework-scoped runtime dep; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:@antv/l7-core | AI (phantom-deps): Same-org monorepo dep; phantom-dep heuristic is a stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:@antv/l7-utils | AI (phantom-deps): Same-org monorepo dep; phantom-dep heuristic is a stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:mapbox-gl | AI (phantom-deps): Map provider dep referenced in config; expected pattern for a maps abstraction package. | ai | |
| phantom-deps | phantom-dep:maplibre-gl | AI (phantom-deps): Map provider dep referenced in config; expected pattern for a maps abstraction package. | ai |
Versions (showing 24 of 24)
| Version | Deps | Published |
|---|---|---|
| 2.29.1 | 11 / 7 | |
| 2.29.0 | 11 / 7 | |
| 2.28.14 | 11 / 7 | |
| 2.28.13 | 11 / 7 | |
| 2.28.12 | 11 / 7 | |
| 2.28.11 | 11 / 7 | |
| 2.28.10 | 11 / 7 | |
| 2.25.10 | 11 / 7 | |
| 2.25.9 | 11 / 7 | |
| 2.25.7 | 11 / 7 | |
| 2.25.6 | 11 / 7 | |
| 2.25.5 | 11 / 7 | |
| 2.25.1 | 11 / 7 | |
| 2.24.1 | 11 / 7 | |
| 2.23.1 | 11 / 7 | |
| 2.23.0 | 11 / 7 | |
| 2.22.7 | 11 / 7 | |
| 2.22.6 | 11 / 7 | |
| 2.22.5 | 11 / 7 | |
| 2.22.4 | 11 / 7 | |
| 2.22.3 | 10 / 7 | |
| 2.22.2 | 10 / 7 | |
| 2.22.1 | 10 / 7 | |
| 2.22.0 | 10 / 7 |
v2.29.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.29.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.22.5
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.22.4
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.22.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.22.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.22.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v2.22.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.