@asgardeo/vue — Greenflagged

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures No source commit

Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.

Maintainers

wso2-org

Keywords

asgardeoauthenticationidentityoauthoidcvuevue3loginssoidentity-management

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
npm-metadata	url-dep:@wso2/eslint-plugin	AI (npm-metadata): devDependency only; does not affect published runtime artifact. WSO2 org package with clean track record.	ai	2026/05/22
npm-metadata	url-dep:@wso2/prettier-config	AI (npm-metadata): devDependency only; does not affect published runtime artifact. WSO2 org package with clean track record.	ai	2026/05/22
phantom-deps	phantom-dep:jose	AI (phantom-deps): Bundled via rollup; declared deps may not appear as direct imports in source.	ai	2026/05/22
phantom-deps	phantom-dep:buffer	AI (phantom-deps): Bundled via rollup; declared deps may not appear as direct imports in source.	ai	2026/05/22
phantom-deps	phantom-dep:base64url	AI (phantom-deps): Bundled via rollup; declared deps may not appear as direct imports in source.	ai	2026/05/22
phantom-deps	phantom-dep:clsx	AI (phantom-deps): Bundled via rollup; declared deps may not appear as direct imports in source.	ai	2026/05/22
phantom-deps	phantom-dep:randombytes	AI (phantom-deps): Bundled via rollup; declared deps may not appear as direct imports in source.	ai	2026/05/22
phantom-deps	phantom-dep:@asgardeo/js	AI (phantom-deps): Same-org sibling package; bundled via rollup build pipeline.	ai	2026/05/22
phantom-deps	phantom-dep:@vitejs/plugin-vue	AI (phantom-deps): Build-time rollup plugin; not imported in runtime source.	ai	2026/05/22
phantom-deps	phantom-dep:fast-sha256	AI (phantom-deps): Bundled via rollup; declared deps may not appear as direct imports in source.	ai	2026/05/22
typosquat	typosquat.levenshtein:vite	AI (typosquat): Scoped @asgardeo/vue is a Vue 3 SDK by WSO2, not a typosquat of vite.	ai	2026/05/21
phantom-deps	phantom-dep:tslib	AI (phantom-deps): tslib is a known implicit TypeScript runtime dep; declared in dependencies as expected.	ai	2026/05/21
typosquat	typosquat.levenshtein:yup	AI (typosquat): Scoped @asgardeo/vue is a Vue 3 SDK by WSO2, not a typosquat of yup.	ai	2026/05/21

Versions (showing 28 of 28)

Version	Deps	Published
0.4.0	4 / 12	2026-05-13
0.3.10	4 / 12	2026-05-12
0.3.9	4 / 12	2026-05-11
0.3.8	4 / 12	2026-05-11
0.3.7	4 / 12	2026-05-06
0.3.6	4 / 12	2026-05-05
0.3.5	4 / 12	2026-04-29
0.3.4	4 / 12	2026-04-28
0.3.3	4 / 12	2026-04-21
0.3.2	4 / 12	2026-04-20
0.3.1	4 / 12	2026-04-16
0.3.0	4 / 12	2026-04-10
0.2.4	4 / 12	2026-04-10
0.2.3	4 / 12	2026-04-09
0.2.2	4 / 12	2026-04-08
0.2.1	4 / 12	2026-04-08
0.2.0	4 / 12	2026-04-06
0.1.0	4 / 12	2026-04-02
0.0.10	9 / 26	2026-02-09
0.0.9	9 / 25	2025-12-12
0.0.8	9 / 25	2025-12-04
0.0.7	9 / 25	2025-11-27
0.0.6	9 / 25	2025-09-06
0.0.5	9 / 25	2025-08-04
0.0.4	9 / 25	2025-07-07
0.0.3	9 / 25	2025-07-04
0.0.2	9 / 25	2025-06-30
0.0.1	9 / 25	2025-05-23

v0.4.0

3 findings

HIGH SHA-pinned github dependency (devDependencies): @wso2/eslint-plugin npm-metadata

Dependency '@wso2/eslint-plugin' in `devDependencies` points to 'git+https://github.com/brionmario/wso2-ui-configs.git#d3041825a4f8f235c8f9fa36b55cf29d54e791c8&path:packages/eslint-plugin' instead of a registry version. URL dependencies bypass the registry and can be swapped at any time. A 40-character commit SHA in a dependency URL is a strong supply-chain signal — the 2026-05-11 TanStack/Mini Shai-Hulud attack used this exact shape in `optionalDependencies` to smuggle a malicious payload past lifecycle-script and OSV checks.

HIGH SHA-pinned github dependency (devDependencies): @wso2/prettier-config npm-metadata

Dependency '@wso2/prettier-config' in `devDependencies` points to 'git+https://github.com/brionmario/wso2-ui-configs.git#d3041825a4f8f235c8f9fa36b55cf29d54e791c8&path:packages/prettier-config' instead of a registry version. URL dependencies bypass the registry and can be swapped at any time. A 40-character commit SHA in a dependency URL is a strong supply-chain signal — the 2026-05-11 TanStack/Mini Shai-Hulud attack used this exact shape in `optionalDependencies` to smuggle a malicious payload past lifecycle-script and OSV checks.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.3.10

3 findings

HIGH SHA-pinned github dependency (devDependencies): @wso2/eslint-plugin npm-metadata

Dependency '@wso2/eslint-plugin' in `devDependencies` points to 'git+https://github.com/brionmario/wso2-ui-configs.git#d3041825a4f8f235c8f9fa36b55cf29d54e791c8&path:packages/eslint-plugin' instead of a registry version. URL dependencies bypass the registry and can be swapped at any time. A 40-character commit SHA in a dependency URL is a strong supply-chain signal — the 2026-05-11 TanStack/Mini Shai-Hulud attack used this exact shape in `optionalDependencies` to smuggle a malicious payload past lifecycle-script and OSV checks.

HIGH SHA-pinned github dependency (devDependencies): @wso2/prettier-config npm-metadata

Dependency '@wso2/prettier-config' in `devDependencies` points to 'git+https://github.com/brionmario/wso2-ui-configs.git#d3041825a4f8f235c8f9fa36b55cf29d54e791c8&path:packages/prettier-config' instead of a registry version. URL dependencies bypass the registry and can be swapped at any time. A 40-character commit SHA in a dependency URL is a strong supply-chain signal — the 2026-05-11 TanStack/Mini Shai-Hulud attack used this exact shape in `optionalDependencies` to smuggle a malicious payload past lifecycle-script and OSV checks.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.3.9

3 findings

HIGH SHA-pinned github dependency (devDependencies): @wso2/eslint-plugin npm-metadata

Dependency '@wso2/eslint-plugin' in `devDependencies` points to 'git+https://github.com/brionmario/wso2-ui-configs.git#d3041825a4f8f235c8f9fa36b55cf29d54e791c8&path:packages/eslint-plugin' instead of a registry version. URL dependencies bypass the registry and can be swapped at any time. A 40-character commit SHA in a dependency URL is a strong supply-chain signal — the 2026-05-11 TanStack/Mini Shai-Hulud attack used this exact shape in `optionalDependencies` to smuggle a malicious payload past lifecycle-script and OSV checks.

HIGH SHA-pinned github dependency (devDependencies): @wso2/prettier-config npm-metadata

Dependency '@wso2/prettier-config' in `devDependencies` points to 'git+https://github.com/brionmario/wso2-ui-configs.git#d3041825a4f8f235c8f9fa36b55cf29d54e791c8&path:packages/prettier-config' instead of a registry version. URL dependencies bypass the registry and can be swapped at any time. A 40-character commit SHA in a dependency URL is a strong supply-chain signal — the 2026-05-11 TanStack/Mini Shai-Hulud attack used this exact shape in `optionalDependencies` to smuggle a malicious payload past lifecycle-script and OSV checks.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.3.8

3 findings

HIGH SHA-pinned github dependency (devDependencies): @wso2/eslint-plugin npm-metadata

Dependency '@wso2/eslint-plugin' in `devDependencies` points to 'git+https://github.com/brionmario/wso2-ui-configs.git#d3041825a4f8f235c8f9fa36b55cf29d54e791c8&path:packages/eslint-plugin' instead of a registry version. URL dependencies bypass the registry and can be swapped at any time. A 40-character commit SHA in a dependency URL is a strong supply-chain signal — the 2026-05-11 TanStack/Mini Shai-Hulud attack used this exact shape in `optionalDependencies` to smuggle a malicious payload past lifecycle-script and OSV checks.

HIGH SHA-pinned github dependency (devDependencies): @wso2/prettier-config npm-metadata

Dependency '@wso2/prettier-config' in `devDependencies` points to 'git+https://github.com/brionmario/wso2-ui-configs.git#d3041825a4f8f235c8f9fa36b55cf29d54e791c8&path:packages/prettier-config' instead of a registry version. URL dependencies bypass the registry and can be swapped at any time. A 40-character commit SHA in a dependency URL is a strong supply-chain signal — the 2026-05-11 TanStack/Mini Shai-Hulud attack used this exact shape in `optionalDependencies` to smuggle a malicious payload past lifecycle-script and OSV checks.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.3.7

3 findings

HIGH SHA-pinned github dependency (devDependencies): @wso2/eslint-plugin npm-metadata

Dependency '@wso2/eslint-plugin' in `devDependencies` points to 'git+https://github.com/brionmario/wso2-ui-configs.git#d3041825a4f8f235c8f9fa36b55cf29d54e791c8&path:packages/eslint-plugin' instead of a registry version. URL dependencies bypass the registry and can be swapped at any time. A 40-character commit SHA in a dependency URL is a strong supply-chain signal — the 2026-05-11 TanStack/Mini Shai-Hulud attack used this exact shape in `optionalDependencies` to smuggle a malicious payload past lifecycle-script and OSV checks.

HIGH SHA-pinned github dependency (devDependencies): @wso2/prettier-config npm-metadata

Dependency '@wso2/prettier-config' in `devDependencies` points to 'git+https://github.com/brionmario/wso2-ui-configs.git#d3041825a4f8f235c8f9fa36b55cf29d54e791c8&path:packages/prettier-config' instead of a registry version. URL dependencies bypass the registry and can be swapped at any time. A 40-character commit SHA in a dependency URL is a strong supply-chain signal — the 2026-05-11 TanStack/Mini Shai-Hulud attack used this exact shape in `optionalDependencies` to smuggle a malicious payload past lifecycle-script and OSV checks.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.3.6

3 findings

HIGH SHA-pinned github dependency (devDependencies): @wso2/eslint-plugin npm-metadata

Dependency '@wso2/eslint-plugin' in `devDependencies` points to 'git+https://github.com/brionmario/wso2-ui-configs.git#d3041825a4f8f235c8f9fa36b55cf29d54e791c8&path:packages/eslint-plugin' instead of a registry version. URL dependencies bypass the registry and can be swapped at any time. A 40-character commit SHA in a dependency URL is a strong supply-chain signal — the 2026-05-11 TanStack/Mini Shai-Hulud attack used this exact shape in `optionalDependencies` to smuggle a malicious payload past lifecycle-script and OSV checks.

HIGH SHA-pinned github dependency (devDependencies): @wso2/prettier-config npm-metadata

Dependency '@wso2/prettier-config' in `devDependencies` points to 'git+https://github.com/brionmario/wso2-ui-configs.git#d3041825a4f8f235c8f9fa36b55cf29d54e791c8&path:packages/prettier-config' instead of a registry version. URL dependencies bypass the registry and can be swapped at any time. A 40-character commit SHA in a dependency URL is a strong supply-chain signal — the 2026-05-11 TanStack/Mini Shai-Hulud attack used this exact shape in `optionalDependencies` to smuggle a malicious payload past lifecycle-script and OSV checks.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.3.4

3 findings

HIGH SHA-pinned github dependency (devDependencies): @wso2/eslint-plugin npm-metadata

Dependency '@wso2/eslint-plugin' in `devDependencies` points to 'git+https://github.com/brionmario/wso2-ui-configs.git#d3041825a4f8f235c8f9fa36b55cf29d54e791c8&path:packages/eslint-plugin' instead of a registry version. URL dependencies bypass the registry and can be swapped at any time. A 40-character commit SHA in a dependency URL is a strong supply-chain signal — the 2026-05-11 TanStack/Mini Shai-Hulud attack used this exact shape in `optionalDependencies` to smuggle a malicious payload past lifecycle-script and OSV checks.

HIGH SHA-pinned github dependency (devDependencies): @wso2/prettier-config npm-metadata

Dependency '@wso2/prettier-config' in `devDependencies` points to 'git+https://github.com/brionmario/wso2-ui-configs.git#d3041825a4f8f235c8f9fa36b55cf29d54e791c8&path:packages/prettier-config' instead of a registry version. URL dependencies bypass the registry and can be swapped at any time. A 40-character commit SHA in a dependency URL is a strong supply-chain signal — the 2026-05-11 TanStack/Mini Shai-Hulud attack used this exact shape in `optionalDependencies` to smuggle a malicious payload past lifecycle-script and OSV checks.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.3.3

3 findings

HIGH SHA-pinned github dependency (devDependencies): @wso2/eslint-plugin npm-metadata

Dependency '@wso2/eslint-plugin' in `devDependencies` points to 'git+https://github.com/brionmario/wso2-ui-configs.git#d3041825a4f8f235c8f9fa36b55cf29d54e791c8&path:packages/eslint-plugin' instead of a registry version. URL dependencies bypass the registry and can be swapped at any time. A 40-character commit SHA in a dependency URL is a strong supply-chain signal — the 2026-05-11 TanStack/Mini Shai-Hulud attack used this exact shape in `optionalDependencies` to smuggle a malicious payload past lifecycle-script and OSV checks.

HIGH SHA-pinned github dependency (devDependencies): @wso2/prettier-config npm-metadata

Dependency '@wso2/prettier-config' in `devDependencies` points to 'git+https://github.com/brionmario/wso2-ui-configs.git#d3041825a4f8f235c8f9fa36b55cf29d54e791c8&path:packages/prettier-config' instead of a registry version. URL dependencies bypass the registry and can be swapped at any time. A 40-character commit SHA in a dependency URL is a strong supply-chain signal — the 2026-05-11 TanStack/Mini Shai-Hulud attack used this exact shape in `optionalDependencies` to smuggle a malicious payload past lifecycle-script and OSV checks.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.3.2

3 findings

HIGH SHA-pinned github dependency (devDependencies): @wso2/eslint-plugin npm-metadata

Dependency '@wso2/eslint-plugin' in `devDependencies` points to 'git+https://github.com/brionmario/wso2-ui-configs.git#d3041825a4f8f235c8f9fa36b55cf29d54e791c8&path:packages/eslint-plugin' instead of a registry version. URL dependencies bypass the registry and can be swapped at any time. A 40-character commit SHA in a dependency URL is a strong supply-chain signal — the 2026-05-11 TanStack/Mini Shai-Hulud attack used this exact shape in `optionalDependencies` to smuggle a malicious payload past lifecycle-script and OSV checks.

HIGH SHA-pinned github dependency (devDependencies): @wso2/prettier-config npm-metadata

Dependency '@wso2/prettier-config' in `devDependencies` points to 'git+https://github.com/brionmario/wso2-ui-configs.git#d3041825a4f8f235c8f9fa36b55cf29d54e791c8&path:packages/prettier-config' instead of a registry version. URL dependencies bypass the registry and can be swapped at any time. A 40-character commit SHA in a dependency URL is a strong supply-chain signal — the 2026-05-11 TanStack/Mini Shai-Hulud attack used this exact shape in `optionalDependencies` to smuggle a malicious payload past lifecycle-script and OSV checks.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.3.1

3 findings

HIGH SHA-pinned github dependency (devDependencies): @wso2/eslint-plugin npm-metadata

Dependency '@wso2/eslint-plugin' in `devDependencies` points to 'git+https://github.com/brionmario/wso2-ui-configs.git#d3041825a4f8f235c8f9fa36b55cf29d54e791c8&path:packages/eslint-plugin' instead of a registry version. URL dependencies bypass the registry and can be swapped at any time. A 40-character commit SHA in a dependency URL is a strong supply-chain signal — the 2026-05-11 TanStack/Mini Shai-Hulud attack used this exact shape in `optionalDependencies` to smuggle a malicious payload past lifecycle-script and OSV checks.

HIGH SHA-pinned github dependency (devDependencies): @wso2/prettier-config npm-metadata

Dependency '@wso2/prettier-config' in `devDependencies` points to 'git+https://github.com/brionmario/wso2-ui-configs.git#d3041825a4f8f235c8f9fa36b55cf29d54e791c8&path:packages/prettier-config' instead of a registry version. URL dependencies bypass the registry and can be swapped at any time. A 40-character commit SHA in a dependency URL is a strong supply-chain signal — the 2026-05-11 TanStack/Mini Shai-Hulud attack used this exact shape in `optionalDependencies` to smuggle a malicious payload past lifecycle-script and OSV checks.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.3.0

3 findings

HIGH SHA-pinned github dependency (devDependencies): @wso2/eslint-plugin npm-metadata

Dependency '@wso2/eslint-plugin' in `devDependencies` points to 'git+https://github.com/brionmario/wso2-ui-configs.git#d3041825a4f8f235c8f9fa36b55cf29d54e791c8&path:packages/eslint-plugin' instead of a registry version. URL dependencies bypass the registry and can be swapped at any time. A 40-character commit SHA in a dependency URL is a strong supply-chain signal — the 2026-05-11 TanStack/Mini Shai-Hulud attack used this exact shape in `optionalDependencies` to smuggle a malicious payload past lifecycle-script and OSV checks.

HIGH SHA-pinned github dependency (devDependencies): @wso2/prettier-config npm-metadata

Dependency '@wso2/prettier-config' in `devDependencies` points to 'git+https://github.com/brionmario/wso2-ui-configs.git#d3041825a4f8f235c8f9fa36b55cf29d54e791c8&path:packages/prettier-config' instead of a registry version. URL dependencies bypass the registry and can be swapped at any time. A 40-character commit SHA in a dependency URL is a strong supply-chain signal — the 2026-05-11 TanStack/Mini Shai-Hulud attack used this exact shape in `optionalDependencies` to smuggle a malicious payload past lifecycle-script and OSV checks.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.2.4

3 findings

HIGH SHA-pinned github dependency (devDependencies): @wso2/eslint-plugin npm-metadata

Dependency '@wso2/eslint-plugin' in `devDependencies` points to 'git+https://github.com/brionmario/wso2-ui-configs.git#d3041825a4f8f235c8f9fa36b55cf29d54e791c8&path:packages/eslint-plugin' instead of a registry version. URL dependencies bypass the registry and can be swapped at any time. A 40-character commit SHA in a dependency URL is a strong supply-chain signal — the 2026-05-11 TanStack/Mini Shai-Hulud attack used this exact shape in `optionalDependencies` to smuggle a malicious payload past lifecycle-script and OSV checks.

HIGH SHA-pinned github dependency (devDependencies): @wso2/prettier-config npm-metadata

Dependency '@wso2/prettier-config' in `devDependencies` points to 'git+https://github.com/brionmario/wso2-ui-configs.git#d3041825a4f8f235c8f9fa36b55cf29d54e791c8&path:packages/prettier-config' instead of a registry version. URL dependencies bypass the registry and can be swapped at any time. A 40-character commit SHA in a dependency URL is a strong supply-chain signal — the 2026-05-11 TanStack/Mini Shai-Hulud attack used this exact shape in `optionalDependencies` to smuggle a malicious payload past lifecycle-script and OSV checks.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.2.3

3 findings

HIGH SHA-pinned github dependency (devDependencies): @wso2/eslint-plugin npm-metadata

Dependency '@wso2/eslint-plugin' in `devDependencies` points to 'git+https://github.com/brionmario/wso2-ui-configs.git#d3041825a4f8f235c8f9fa36b55cf29d54e791c8&path:packages/eslint-plugin' instead of a registry version. URL dependencies bypass the registry and can be swapped at any time. A 40-character commit SHA in a dependency URL is a strong supply-chain signal — the 2026-05-11 TanStack/Mini Shai-Hulud attack used this exact shape in `optionalDependencies` to smuggle a malicious payload past lifecycle-script and OSV checks.

HIGH SHA-pinned github dependency (devDependencies): @wso2/prettier-config npm-metadata

Dependency '@wso2/prettier-config' in `devDependencies` points to 'git+https://github.com/brionmario/wso2-ui-configs.git#d3041825a4f8f235c8f9fa36b55cf29d54e791c8&path:packages/prettier-config' instead of a registry version. URL dependencies bypass the registry and can be swapped at any time. A 40-character commit SHA in a dependency URL is a strong supply-chain signal — the 2026-05-11 TanStack/Mini Shai-Hulud attack used this exact shape in `optionalDependencies` to smuggle a malicious payload past lifecycle-script and OSV checks.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.2.2

3 findings

HIGH SHA-pinned github dependency (devDependencies): @wso2/eslint-plugin npm-metadata

Dependency '@wso2/eslint-plugin' in `devDependencies` points to 'git+https://github.com/brionmario/wso2-ui-configs.git#d3041825a4f8f235c8f9fa36b55cf29d54e791c8&path:packages/eslint-plugin' instead of a registry version. URL dependencies bypass the registry and can be swapped at any time. A 40-character commit SHA in a dependency URL is a strong supply-chain signal — the 2026-05-11 TanStack/Mini Shai-Hulud attack used this exact shape in `optionalDependencies` to smuggle a malicious payload past lifecycle-script and OSV checks.

HIGH SHA-pinned github dependency (devDependencies): @wso2/prettier-config npm-metadata

Dependency '@wso2/prettier-config' in `devDependencies` points to 'git+https://github.com/brionmario/wso2-ui-configs.git#d3041825a4f8f235c8f9fa36b55cf29d54e791c8&path:packages/prettier-config' instead of a registry version. URL dependencies bypass the registry and can be swapped at any time. A 40-character commit SHA in a dependency URL is a strong supply-chain signal — the 2026-05-11 TanStack/Mini Shai-Hulud attack used this exact shape in `optionalDependencies` to smuggle a malicious payload past lifecycle-script and OSV checks.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.2.1

3 findings

HIGH SHA-pinned github dependency (devDependencies): @wso2/eslint-plugin npm-metadata

Dependency '@wso2/eslint-plugin' in `devDependencies` points to 'git+https://github.com/brionmario/wso2-ui-configs.git#d3041825a4f8f235c8f9fa36b55cf29d54e791c8&path:packages/eslint-plugin' instead of a registry version. URL dependencies bypass the registry and can be swapped at any time. A 40-character commit SHA in a dependency URL is a strong supply-chain signal — the 2026-05-11 TanStack/Mini Shai-Hulud attack used this exact shape in `optionalDependencies` to smuggle a malicious payload past lifecycle-script and OSV checks.

HIGH SHA-pinned github dependency (devDependencies): @wso2/prettier-config npm-metadata

Dependency '@wso2/prettier-config' in `devDependencies` points to 'git+https://github.com/brionmario/wso2-ui-configs.git#d3041825a4f8f235c8f9fa36b55cf29d54e791c8&path:packages/prettier-config' instead of a registry version. URL dependencies bypass the registry and can be swapped at any time. A 40-character commit SHA in a dependency URL is a strong supply-chain signal — the 2026-05-11 TanStack/Mini Shai-Hulud attack used this exact shape in `optionalDependencies` to smuggle a malicious payload past lifecycle-script and OSV checks.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.2.0

3 findings

HIGH SHA-pinned github dependency (devDependencies): @wso2/eslint-plugin npm-metadata

Dependency '@wso2/eslint-plugin' in `devDependencies` points to 'git+https://github.com/brionmario/wso2-ui-configs.git#d3041825a4f8f235c8f9fa36b55cf29d54e791c8&path:packages/eslint-plugin' instead of a registry version. URL dependencies bypass the registry and can be swapped at any time. A 40-character commit SHA in a dependency URL is a strong supply-chain signal — the 2026-05-11 TanStack/Mini Shai-Hulud attack used this exact shape in `optionalDependencies` to smuggle a malicious payload past lifecycle-script and OSV checks.

HIGH SHA-pinned github dependency (devDependencies): @wso2/prettier-config npm-metadata

Dependency '@wso2/prettier-config' in `devDependencies` points to 'git+https://github.com/brionmario/wso2-ui-configs.git#d3041825a4f8f235c8f9fa36b55cf29d54e791c8&path:packages/prettier-config' instead of a registry version. URL dependencies bypass the registry and can be swapped at any time. A 40-character commit SHA in a dependency URL is a strong supply-chain signal — the 2026-05-11 TanStack/Mini Shai-Hulud attack used this exact shape in `optionalDependencies` to smuggle a malicious payload past lifecycle-script and OSV checks.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.1.0

3 findings

HIGH SHA-pinned github dependency (devDependencies): @wso2/eslint-plugin npm-metadata

Dependency '@wso2/eslint-plugin' in `devDependencies` points to 'git+https://github.com/brionmario/wso2-ui-configs.git#d3041825a4f8f235c8f9fa36b55cf29d54e791c8&path:packages/eslint-plugin' instead of a registry version. URL dependencies bypass the registry and can be swapped at any time. A 40-character commit SHA in a dependency URL is a strong supply-chain signal — the 2026-05-11 TanStack/Mini Shai-Hulud attack used this exact shape in `optionalDependencies` to smuggle a malicious payload past lifecycle-script and OSV checks.

HIGH SHA-pinned github dependency (devDependencies): @wso2/prettier-config npm-metadata

Dependency '@wso2/prettier-config' in `devDependencies` points to 'git+https://github.com/brionmario/wso2-ui-configs.git#d3041825a4f8f235c8f9fa36b55cf29d54e791c8&path:packages/prettier-config' instead of a registry version. URL dependencies bypass the registry and can be swapped at any time. A 40-character commit SHA in a dependency URL is a strong supply-chain signal — the 2026-05-11 TanStack/Mini Shai-Hulud attack used this exact shape in `optionalDependencies` to smuggle a malicious payload past lifecycle-script and OSV checks.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.0.10

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.0.9

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.0.8

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.0.7

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.0.6

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.0.5

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.0.4

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.0.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.0.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.0.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.