@apollosproject/web-embeds
Next-generation embeddable widget system for Apollos
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| provenance | no-provenance | AI (provenance): Published by GitHub Actions CI/CD; provenance attestation not yet enabled but automated publishing is low-risk. | ai | |
| publish-pattern | rapid-publish | AI (publish-pattern): Frequent CI-driven releases are normal cadence for this package. | ai | |
| dependencies | unvetted-dep:@apollosproject/canvas-ui-web | AI (dependencies): Same-org workspace package, part of monorepo split. | ai | |
| phantom-deps | phantom-dep:react-dom | AI (phantom-deps): Config-referenced framework dep, standard monorepo pattern. | ai | |
| phantom-deps | phantom-dep:@apollosproject/canvas-ui-web | AI (phantom-deps): Same org workspace dep, not directly imported by design. | ai | |
| phantom-deps | phantom-dep:react | AI (phantom-deps): Config-referenced framework dep, standard monorepo pattern. | ai | |
| provenance | publisher-changed | AI (provenance): Switch to GitHub Actions CI publisher, not an unrelated/compromised account. | ai |
Versions (showing 51 of 377)
| Version | Deps | Published |
|---|---|---|
| 0.1.569 | 3 / 13 | |
| 0.1.559 | 3 / 13 | |
| 0.1.553 | 3 / 13 | |
| 0.1.548 | 3 / 13 | |
| 0.1.541 | 3 / 13 | |
| 0.1.537 | 3 / 13 | |
| 0.1.533 | 3 / 13 | |
| 0.1.525 | 3 / 13 | |
| 0.1.518 | 3 / 13 | |
| 0.1.507 | 3 / 13 | |
| 0.1.498 | 3 / 13 | |
| 0.1.496 | 3 / 13 | |
| 0.1.490 | 3 / 13 | |
| 0.1.484 | 3 / 13 | |
| 0.1.466 | 3 / 13 | |
| 0.1.459 | 3 / 13 | |
| 0.1.457 | 3 / 13 | |
| 0.1.452 | 3 / 11 | |
| 0.1.447 | 3 / 11 | |
| 0.1.442 | 3 / 11 | |
| 0.1.425 | 3 / 11 | |
| 0.1.387 | 3 / 11 | |
| 0.1.355 | 2 / 11 | |
| 0.1.354 | 2 / 11 | |
| 0.1.353 | 2 / 11 | |
| 0.1.352 | 2 / 11 | |
| 0.1.351 | 2 / 11 | |
| 0.1.350 | 2 / 11 | |
| 0.1.349 | 2 / 11 | |
| 0.1.348 | 2 / 11 | |
| 0.1.347 | 2 / 11 | |
| 0.1.346 | 2 / 11 | |
| 0.1.345 | 2 / 11 | |
| 0.1.344 | 2 / 11 | |
| 0.1.343 | 2 / 11 | |
| 0.1.342 | 2 / 11 | |
| 0.1.341 | 2 / 11 | |
| 0.1.340 | 2 / 11 | |
| 0.1.339 | 2 / 11 | |
| 0.1.338 | 2 / 11 | |
| 0.1.337 | 2 / 11 | |
| 0.1.336 | 2 / 11 | |
| 0.1.335 | 2 / 11 | |
| 0.1.334 | 2 / 11 | |
| 0.1.333 | 2 / 11 | |
| 0.1.332 | 2 / 11 | |
| 0.1.331 | 2 / 11 | |
| 0.1.330 | 2 / 11 | |
| 0.1.329 | 2 / 11 | |
| 0.1.328 | 2 / 11 | |
| 0.1.327 | 2 / 11 |
v0.1.569
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.1.559
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.1.553
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.1.548
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.1.541
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.1.537
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.1.533
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.1.525
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.1.518
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.1.507
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.1.498
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.1.496
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.1.490
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.1.484
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.1.466
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.1.459
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.1.457
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.1.452
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.1.447
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.1.442
2 findingsThis version was published by a different npm account than previous versions on 2026-07-06. This could indicate a legitimate maintainer transition or an account compromise.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.1.425
2 findingsThis version was published by a different npm account than previous versions on 2026-06-30. This could indicate a legitimate maintainer transition or an account compromise.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.