← Home

@backstage/plugin-signals-backend

npm Repository
30
Versions
Apache-2.0
License
No
Install Scripts
Missing
Provenance

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.

Maintainers

patrikofrebenmarcuseide

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
phantom-deps phantom-dep:yn AI (phantom-deps): Utility library used in Backstage backend plugins; phantom-dep pattern is stable. ai
phantom-deps phantom-dep:winston AI (phantom-deps): Standard logging library in Backstage backend; phantom-dep pattern is stable. ai
phantom-deps phantom-dep:http-proxy-middleware AI (phantom-deps): Express middleware used in backend plugin; phantom-dep pattern is stable. ai
phantom-deps phantom-dep:@backstage/plugin-auth-node AI (phantom-deps): Same-org Backstage dependency; phantom-dep pattern is stable for plugins. ai
phantom-deps phantom-dep:@backstage/types AI (phantom-deps): Same-org @backstage scoped package; phantom dep in monorepo sub-packages is expected and not a risk signal. ai
npm-metadata no-description AI (npm-metadata): Backstage monorepo sub-packages routinely omit standalone descriptions; not a risk signal for this established package. ai
phantom-deps phantom-dep:@backstage/config AI (phantom-deps): Same-org @backstage scoped package; phantom dep in monorepo sub-packages is expected and not a risk signal. ai
phantom-deps phantom-dep:@backstage/plugin-signals-node AI (phantom-deps): Same-org @backstage scoped package; phantom dep in monorepo sub-packages is expected and not a risk signal. ai
bogus-package bogus-package AI (bogus-package): Monorepo sub-packages commonly lack standalone README/keywords/description; not indicative of spam or malice for this well-established Backstage plugin. ai

Versions (showing 30 of 30)

Version Deps Published
0.3.17 8 / 10
0.3.16 8 / 10
0.3.15 8 / 10
0.3.14 9 / 10
0.3.13 9 / 10
0.3.12 9 / 10
0.3.11 9 / 10
0.3.10 9 / 10
0.3.9 13 / 11
0.3.8 13 / 11
0.3.7 13 / 11
0.3.6 13 / 11
0.3.5 13 / 11
0.3.4 13 / 11
0.3.3 13 / 11
0.3.2 13 / 11
0.3.1 13 / 11
0.3.0 13 / 11
0.2.4 15 / 10
0.2.3 16 / 10
0.2.2 16 / 10
0.2.1 16 / 10
0.2.0 16 / 10
0.1.10 16 / 10
0.1.9 16 / 10
0.1.8 16 / 10
0.1.7 16 / 10
0.1.6 16 / 10
0.1.5 16 / 10
0.1.4 16 / 9

v0.3.17

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.3.3

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.3.2

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.3.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.3.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.2.4

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.2.3

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.2.2

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.2.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.2.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.1.10

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.1.9

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.1.8

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.1.7

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.1.6

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.1.5

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.1.4

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.