← Home

@awell-health/awell-extensions

npm Repository Homepage
51
Versions
—
License
No
Install Scripts
Missing
Provenance

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.

Maintainers

awell-jonathanebomcke-awellpawelskr

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
provenance no-provenance AI (provenance): Provenance attestation is absent in ~88% of npm packages; not a disqualifier for an established, well-maintained package with strong publisher history. ai
npm-metadata no-description AI (npm-metadata): Established 1070-day-old package with proper repo/homepage URLs; missing description is a cosmetic issue, not a malware signal. ai
phantom-deps phantom-dep:xml2js AI (phantom-deps): xml2js is a declared runtime dependency; indirect usage pattern is expected in a large multi-integration extensions library. ai
phantom-deps phantom-dep:@types/json-schema AI (phantom-deps): Framework-scoped type package loaded by convention; stable false positive for this package. ai
phantom-deps phantom-dep:jsonpath AI (phantom-deps): jsonpath is a declared runtime dependency; indirect usage pattern is expected in this extensions library. ai
phantom-deps phantom-dep:openai AI (phantom-deps): openai is a declared runtime dependency used in LangChain/AI integrations within this extensions library; indirect import pattern is expected. ai
dependencies unvetted-dep:sanitize-html AI (dependencies): sanitize-html is a well-known, legitimate HTML sanitization library; expected dependency for a healthcare extensions platform. ai
dependencies unvetted-dep:docusign-esign AI (dependencies): docusign-esign is the official DocuSign Node.js SDK; expected dependency for a healthcare workflow extensions package. ai

Versions (showing 51 of 305)

View all versions
Version Deps Published
2.1.147 54 / 52
2.1.145 54 / 52
2.1.144 54 / 52
2.1.143 54 / 52
2.1.142 54 / 52
2.1.141 54 / 52
2.1.140 54 / 52
2.1.139 54 / 52
2.1.138 54 / 52
2.1.137 54 / 52
2.1.136 54 / 52
2.1.135 54 / 52
2.1.134 54 / 52
2.1.133 54 / 52
2.1.132 54 / 52
2.1.131 54 / 52
2.1.130 55 / 52
2.1.129 55 / 52
2.1.128 55 / 52
2.1.127 55 / 52
2.1.126 55 / 52
2.1.125 55 / 52
2.1.124 55 / 52
2.1.123 55 / 52
2.1.122 55 / 52
2.1.121 55 / 52
2.1.120 55 / 52
2.1.119 55 / 52
2.1.118 53 / 52
2.1.117 53 / 52
2.1.116 53 / 52
2.1.115 53 / 52
2.1.114 53 / 52
2.1.113 54 / 53
2.1.112 54 / 53
2.1.111 54 / 53
2.1.110 54 / 53
2.1.109 54 / 53
2.1.108 54 / 53
2.1.107 54 / 53
2.1.106 54 / 53
2.1.105 54 / 53
2.1.104 54 / 53
2.1.103 54 / 53
2.1.102 54 / 53
2.1.101 54 / 53
2.1.100 54 / 53
2.1.99 54 / 53
2.1.98 54 / 53
2.1.97 54 / 53
2.1.96 53 / 53

v2.1.147

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.1.145

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.1.144

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.1.143

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.1.142

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.1.141

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.1.140

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.1.139

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.1.138

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.1.137

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.1.136

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.1.135

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.1.134

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.