@backstage/plugin-notifications-backend-module-email
The email backend module for the notifications plugin.
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| phantom-deps | phantom-dep:@aws-sdk/types | AI (phantom-deps): AWS SDK types loaded by convention in AWS integration module; stable pattern. | ai | |
| dependencies | unvetted-dep:@aws-sdk/client-sesv2 | AI (dependencies): AWS SES v2 SDK is a legitimate, well-known cloud email dependency; its use is expected for this email notification backend module. | ai | |
| dependencies | unvetted-dep:@azure/communication-email | AI (dependencies): Azure Communication Email SDK is a legitimate Microsoft Azure dependency; its use is expected for this email notification backend module. | ai | |
| phantom-deps | phantom-dep:@backstage/catalog-model | AI (phantom-deps): Same-org phantom dep in a monorepo package; @backstage/catalog-model is a legitimate sibling package and this is a non-issue for the Backstage ecosystem. | ai | |
| provenance | no-provenance | AI (provenance): Backstage monorepo packages historically lack Sigstore provenance; this is consistent across the ecosystem and not a meaningful risk signal for this package. | ai |
Versions (showing 13 of 13)
| Version | Deps | Published |
|---|---|---|
| 0.3.21 | 15 / 3 | |
| 0.3.20 | 15 / 3 | |
| 0.3.19 | 15 / 3 | |
| 0.3.18 | 15 / 3 | |
| 0.3.17 | 15 / 3 | |
| 0.3.16 | 15 / 3 | |
| 0.3.15 | 15 / 3 | |
| 0.3.14 | 15 / 3 | |
| 0.3.13 | 16 / 3 | |
| 0.3.12 | 16 / 3 | |
| 0.3.11 | 16 / 3 | |
| 0.3.10 | 16 / 3 | |
| 0.3.9 | 16 / 3 |
v0.3.21
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.3.20
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.3.19
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.3.18
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.3.17
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.3.16
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.3.15
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.3.14
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.3.13
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.3.12
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.3.11
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.3.10
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.3.9
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.