@axinom/mosaic-message-bus
Messaging library for Axinom Mosaic services
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | encoded-string-file:src/signing/register-public-signing-key.spec.ts | AI (source-diff): Long encoded strings are RSA key fixtures in test files for signing functionality — not obfuscated payloads. | ai | |
| source-diff | encoded-string-file:src/middleware/validate-signed-event-middleware.spec.ts | AI (source-diff): RSA key test fixtures for validate-signed-event middleware tests; benign for this crypto-signing package. | ai | |
| semgrep | semgrep:base64-decode | AI (semgrep): Standard JWT payload decoding pattern; not a malicious payload. | ai | |
| bogus-package | bogus-package | AI (bogus-package): Proprietary commercial package from Axinom; sparse README and no public repo are expected for internal/commercial libs. | ai |
Versions (showing 28 of 28)
| Version | Deps | Published |
|---|---|---|
| 0.51.0 | 12 / 18 | |
| 0.50.0 | 12 / 18 | |
| 0.49.0 | 12 / 18 | |
| 0.48.0 | 12 / 18 | |
| 0.47.0 | 12 / 16 | |
| 0.46.0 | 12 / 16 | |
| 0.45.0 | 12 / 16 | |
| 0.44.0 | 12 / 16 | |
| 0.43.0 | 12 / 16 | |
| 0.42.0 | 12 / 16 | |
| 0.41.0 | 12 / 16 | |
| 0.40.0 | 12 / 16 | |
| 0.39.1 | 12 / 16 | |
| 0.39.0 | 12 / 16 | |
| 0.38.0 | 12 / 16 | |
| 0.37.2 | 12 / 16 | |
| 0.37.1 | 12 / 16 | |
| 0.37.0 | 12 / 16 | |
| 0.36.0 | 12 / 16 | |
| 0.35.0 | 12 / 16 | |
| 0.34.0 | 12 / 15 | |
| 0.33.0 | 12 / 15 | |
| 0.32.0 | 12 / 15 | |
| 0.31.0 | 8 / 10 | |
| 0.30.0 | 7 / 10 | |
| 0.29.0 | 7 / 10 | |
| 0.28.0 | 7 / 10 | |
| 0.27.0 | 7 / 10 |
v0.51.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.38.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.37.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.37.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.37.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.36.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.35.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.34.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.33.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.32.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.31.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.30.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.29.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.28.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.27.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.