@aurodesignsystem/auro-library
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| phantom-deps | phantom-dep:sinon | AI (phantom-deps): sinon is a test utility invoked via test scripts, not imported directly; stable pattern for this package. | ai | |
| phantom-deps | phantom-dep:@aurodesignsystem/auro-cli | AI (phantom-deps): auro-cli is a CLI tool from the same org used in npm scripts, not imported directly; expected pattern. | ai | |
| dependencies | unvetted-dep:handlebars | AI (dependencies): handlebars is a widely-used templating library; stable dependency for this doc-generation package. | ai | |
| phantom-deps | phantom-dep:npm-run-all | AI (phantom-deps): npm-run-all is a declared runtime dep used in scripts; phantom-dep heuristic fires because it's not directly imported in JS. | ai | |
| provenance | no-provenance | AI (provenance): Established org package; lack of provenance is consistent across all versions and not a risk signal here. | ai |
Versions (showing 13 of 13)
| Version | Deps | Published |
|---|---|---|
| 5.12.3 | 3 / 13 | |
| 5.12.2 | 3 / 13 | |
| 5.12.1 | 3 / 13 | |
| 5.12.0 | 3 / 13 | |
| 5.11.3 | 3 / 13 | |
| 5.11.2 | 3 / 13 | |
| 5.11.1 | 3 / 13 | |
| 5.11.0 | 3 / 13 | |
| 5.6.0 | 3 / 13 | |
| 5.5.7 | 3 / 13 | |
| 5.3.0 | 7 / 11 | |
| 5.1.0 | 7 / 11 | |
| 5.0.0 | 4 / 11 |
v5.12.3
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.12.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.12.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.12.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.11.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.11.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.11.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.11.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.6.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.5.7
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.3.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.1.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.0.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.