← Home

@bobfrankston/msgview

npm Repository Homepage

Cross-platform HTML message display using Electron

51
Versions
ISC
License
Yes
Install Scripts
Missing
Provenance

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures No source commit

Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.

Maintainers

bobfrankston

Keywords

electronmessagedialogcross-platform

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
provenance missing-githead AI (provenance): Likely a CI/publish environment change; no other malicious signals present across 143 versions from this publisher. ai
install-scripts install-script:postinstall AI (install-scripts): Electron app postinstall is standard for binary setup; consistent with this package's purpose across versions. ai
semgrep semgrep:env-spread AI (semgrep): env-spread is in CLI launcher passing environment to Electron child process — expected pattern for this tool. ai
semgrep semgrep:base64-decode AI (semgrep): Base64 decode used for UDP IPC data transport, not code execution; benign for this Electron messaging app. ai
phantom-deps phantom-dep:json5 AI (phantom-deps): json5 is a declared dependency likely used in config loading; phantom-dep heuristic false positive. ai
phantom-deps phantom-dep:@bobfrankston/winpos AI (phantom-deps): Same-org scoped package; phantom-dep heuristic false positive for this package. ai

Versions (showing 51 of 143)

View all versions
Version Deps Published
1.0.153 5 / 1
1.0.152 5 / 1
1.0.151 5 / 1
1.0.150 5 / 1
1.0.149 5 / 1
1.0.148 5 / 1
1.0.147 5 / 1
1.0.146 5 / 1
1.0.145 5 / 1
1.0.144 5 / 1
1.0.143 5 / 2
1.0.142 5 / 2
1.0.141 5 / 2
1.0.140 5 / 2
1.0.139 5 / 2
1.0.138 5 / 2
1.0.137 5 / 2
1.0.136 5 / 2
1.0.135 5 / 2
1.0.134 5 / 2
1.0.133 5 / 2
1.0.132 5 / 2
1.0.131 5 / 2
1.0.130 5 / 2
1.0.129 5 / 2
1.0.128 5 / 2
1.0.127 5 / 2
1.0.126 5 / 2
1.0.125 5 / 2
1.0.124 5 / 2
1.0.123 5 / 2
1.0.122 5 / 2
1.0.121 5 / 2
1.0.120 5 / 2
1.0.119 5 / 2
1.0.118 5 / 2
1.0.117 5 / 2
1.0.116 5 / 2
1.0.115 5 / 2
1.0.114 5 / 2
1.0.113 5 / 2
1.0.112 5 / 2
1.0.111 5 / 2
1.0.110 4 / 2
1.0.109 4 / 2
1.0.108 4 / 2
1.0.107 4 / 2
1.0.106 4 / 2
1.0.105 4 / 2
1.0.104 4 / 2
1.0.103 4 / 2

v1.0.153

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.0.152

6 findings
HIGH Package has 'postinstall' script install-scripts

Script: node postinstall.cjs

HIGH env-spread: cli.js:139 semgrep

Spreading entire process.env into an object — may capture all secrets 137 | }; 138 | const env = process.platform === 'linux' > 139 | ? { ...process.env, DISPLAY: process.env.DISPLAY || ':0', DBUS_SESSION_BUS_ADDRESS: '', ...envVars } 140 | : { ...process.env, ...envVars }; 141 | // Get the electron executable path

HIGH env-spread: cli.js:140 semgrep

Spreading entire process.env into an object — may capture all secrets 138 | const env = process.platform === 'linux' 139 | ? { ...process.env, DISPLAY: process.env.DISPLAY || ':0', DBUS_SESSION_BUS_ADDRESS: '', ...envVars } > 140 | : { ...process.env, ...envVars }; 141 | // Get the electron executable path 142 | let electronPath;

HIGH env-spread: cli.ts:151 semgrep

Spreading entire process.env into an object — may capture all secrets 149 | 150 | const env = process.platform === 'linux' > 151 | ? { ...process.env, DISPLAY: process.env.DISPLAY || ':0', DBUS_SESSION_BUS_ADDRESS: '', ...envVars } 152 | : { ...process.env, ...envVars }; 153 |

HIGH env-spread: cli.ts:152 semgrep

Spreading entire process.env into an object — may capture all secrets 150 | const env = process.platform === 'linux' 151 | ? { ...process.env, DISPLAY: process.env.DISPLAY || ':0', DBUS_SESSION_BUS_ADDRESS: '', ...envVars } > 152 | : { ...process.env, ...envVars }; 153 | 154 | // Get the electron executable path

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.0.151

6 findings
HIGH Package has 'postinstall' script install-scripts

Script: node postinstall.cjs

HIGH env-spread: cli.js:139 semgrep

Spreading entire process.env into an object — may capture all secrets 137 | }; 138 | const env = process.platform === 'linux' > 139 | ? { ...process.env, DISPLAY: process.env.DISPLAY || ':0', DBUS_SESSION_BUS_ADDRESS: '', ...envVars } 140 | : { ...process.env, ...envVars }; 141 | // Get the electron executable path

HIGH env-spread: cli.js:140 semgrep

Spreading entire process.env into an object — may capture all secrets 138 | const env = process.platform === 'linux' 139 | ? { ...process.env, DISPLAY: process.env.DISPLAY || ':0', DBUS_SESSION_BUS_ADDRESS: '', ...envVars } > 140 | : { ...process.env, ...envVars }; 141 | // Get the electron executable path 142 | let electronPath;

HIGH env-spread: cli.ts:151 semgrep

Spreading entire process.env into an object — may capture all secrets 149 | 150 | const env = process.platform === 'linux' > 151 | ? { ...process.env, DISPLAY: process.env.DISPLAY || ':0', DBUS_SESSION_BUS_ADDRESS: '', ...envVars } 152 | : { ...process.env, ...envVars }; 153 |

HIGH env-spread: cli.ts:152 semgrep

Spreading entire process.env into an object — may capture all secrets 150 | const env = process.platform === 'linux' 151 | ? { ...process.env, DISPLAY: process.env.DISPLAY || ':0', DBUS_SESSION_BUS_ADDRESS: '', ...envVars } > 152 | : { ...process.env, ...envVars }; 153 | 154 | // Get the electron executable path

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.0.150

6 findings
HIGH Package has 'postinstall' script install-scripts

Script: node postinstall.cjs

HIGH env-spread: cli.js:139 semgrep

Spreading entire process.env into an object — may capture all secrets 137 | }; 138 | const env = process.platform === 'linux' > 139 | ? { ...process.env, DISPLAY: process.env.DISPLAY || ':0', DBUS_SESSION_BUS_ADDRESS: '', ...envVars } 140 | : { ...process.env, ...envVars }; 141 | // Get the electron executable path

HIGH env-spread: cli.js:140 semgrep

Spreading entire process.env into an object — may capture all secrets 138 | const env = process.platform === 'linux' 139 | ? { ...process.env, DISPLAY: process.env.DISPLAY || ':0', DBUS_SESSION_BUS_ADDRESS: '', ...envVars } > 140 | : { ...process.env, ...envVars }; 141 | // Get the electron executable path 142 | let electronPath;

HIGH env-spread: cli.ts:151 semgrep

Spreading entire process.env into an object — may capture all secrets 149 | 150 | const env = process.platform === 'linux' > 151 | ? { ...process.env, DISPLAY: process.env.DISPLAY || ':0', DBUS_SESSION_BUS_ADDRESS: '', ...envVars } 152 | : { ...process.env, ...envVars }; 153 |

HIGH env-spread: cli.ts:152 semgrep

Spreading entire process.env into an object — may capture all secrets 150 | const env = process.platform === 'linux' 151 | ? { ...process.env, DISPLAY: process.env.DISPLAY || ':0', DBUS_SESSION_BUS_ADDRESS: '', ...envVars } > 152 | : { ...process.env, ...envVars }; 153 | 154 | // Get the electron executable path

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.0.149

5 findings
HIGH env-spread: cli.js:122 semgrep

Spreading entire process.env into an object — may capture all secrets 120 | }; 121 | const env = process.platform === 'linux' > 122 | ? { ...process.env, DISPLAY: process.env.DISPLAY || ':0', DBUS_SESSION_BUS_ADDRESS: '', ...envVars } 123 | : { ...process.env, ...envVars }; 124 | // Get the electron executable path

HIGH env-spread: cli.js:123 semgrep

Spreading entire process.env into an object — may capture all secrets 121 | const env = process.platform === 'linux' 122 | ? { ...process.env, DISPLAY: process.env.DISPLAY || ':0', DBUS_SESSION_BUS_ADDRESS: '', ...envVars } > 123 | : { ...process.env, ...envVars }; 124 | // Get the electron executable path 125 | let electronPath;

HIGH env-spread: cli.ts:133 semgrep

Spreading entire process.env into an object — may capture all secrets 131 | 132 | const env = process.platform === 'linux' > 133 | ? { ...process.env, DISPLAY: process.env.DISPLAY || ':0', DBUS_SESSION_BUS_ADDRESS: '', ...envVars } 134 | : { ...process.env, ...envVars }; 135 |

HIGH env-spread: cli.ts:134 semgrep

Spreading entire process.env into an object — may capture all secrets 132 | const env = process.platform === 'linux' 133 | ? { ...process.env, DISPLAY: process.env.DISPLAY || ':0', DBUS_SESSION_BUS_ADDRESS: '', ...envVars } > 134 | : { ...process.env, ...envVars }; 135 | 136 | // Get the electron executable path

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.0.148

5 findings
HIGH env-spread: cli.js:122 semgrep

Spreading entire process.env into an object — may capture all secrets 120 | }; 121 | const env = process.platform === 'linux' > 122 | ? { ...process.env, DISPLAY: process.env.DISPLAY || ':0', DBUS_SESSION_BUS_ADDRESS: '', ...envVars } 123 | : { ...process.env, ...envVars }; 124 | // Get the electron executable path

HIGH env-spread: cli.js:123 semgrep

Spreading entire process.env into an object — may capture all secrets 121 | const env = process.platform === 'linux' 122 | ? { ...process.env, DISPLAY: process.env.DISPLAY || ':0', DBUS_SESSION_BUS_ADDRESS: '', ...envVars } > 123 | : { ...process.env, ...envVars }; 124 | // Get the electron executable path 125 | let electronPath;

HIGH env-spread: cli.ts:133 semgrep

Spreading entire process.env into an object — may capture all secrets 131 | 132 | const env = process.platform === 'linux' > 133 | ? { ...process.env, DISPLAY: process.env.DISPLAY || ':0', DBUS_SESSION_BUS_ADDRESS: '', ...envVars } 134 | : { ...process.env, ...envVars }; 135 |

HIGH env-spread: cli.ts:134 semgrep

Spreading entire process.env into an object — may capture all secrets 132 | const env = process.platform === 'linux' 133 | ? { ...process.env, DISPLAY: process.env.DISPLAY || ':0', DBUS_SESSION_BUS_ADDRESS: '', ...envVars } > 134 | : { ...process.env, ...envVars }; 135 | 136 | // Get the electron executable path

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.0.147

5 findings
HIGH env-spread: cli.js:122 semgrep

Spreading entire process.env into an object — may capture all secrets 120 | }; 121 | const env = process.platform === 'linux' > 122 | ? { ...process.env, DISPLAY: process.env.DISPLAY || ':0', DBUS_SESSION_BUS_ADDRESS: '', ...envVars } 123 | : { ...process.env, ...envVars }; 124 | // Get the electron executable path

HIGH env-spread: cli.js:123 semgrep

Spreading entire process.env into an object — may capture all secrets 121 | const env = process.platform === 'linux' 122 | ? { ...process.env, DISPLAY: process.env.DISPLAY || ':0', DBUS_SESSION_BUS_ADDRESS: '', ...envVars } > 123 | : { ...process.env, ...envVars }; 124 | // Get the electron executable path 125 | let electronPath;

HIGH env-spread: cli.ts:133 semgrep

Spreading entire process.env into an object — may capture all secrets 131 | 132 | const env = process.platform === 'linux' > 133 | ? { ...process.env, DISPLAY: process.env.DISPLAY || ':0', DBUS_SESSION_BUS_ADDRESS: '', ...envVars } 134 | : { ...process.env, ...envVars }; 135 |

HIGH env-spread: cli.ts:134 semgrep

Spreading entire process.env into an object — may capture all secrets 132 | const env = process.platform === 'linux' 133 | ? { ...process.env, DISPLAY: process.env.DISPLAY || ':0', DBUS_SESSION_BUS_ADDRESS: '', ...envVars } > 134 | : { ...process.env, ...envVars }; 135 | 136 | // Get the electron executable path

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.0.146

5 findings
HIGH env-spread: cli.js:122 semgrep

Spreading entire process.env into an object — may capture all secrets 120 | }; 121 | const env = process.platform === 'linux' > 122 | ? { ...process.env, DISPLAY: process.env.DISPLAY || ':0', DBUS_SESSION_BUS_ADDRESS: '', ...envVars } 123 | : { ...process.env, ...envVars }; 124 | // Get the electron executable path

HIGH env-spread: cli.js:123 semgrep

Spreading entire process.env into an object — may capture all secrets 121 | const env = process.platform === 'linux' 122 | ? { ...process.env, DISPLAY: process.env.DISPLAY || ':0', DBUS_SESSION_BUS_ADDRESS: '', ...envVars } > 123 | : { ...process.env, ...envVars }; 124 | // Get the electron executable path 125 | let electronPath;

HIGH env-spread: cli.ts:133 semgrep

Spreading entire process.env into an object — may capture all secrets 131 | 132 | const env = process.platform === 'linux' > 133 | ? { ...process.env, DISPLAY: process.env.DISPLAY || ':0', DBUS_SESSION_BUS_ADDRESS: '', ...envVars } 134 | : { ...process.env, ...envVars }; 135 |

HIGH env-spread: cli.ts:134 semgrep

Spreading entire process.env into an object — may capture all secrets 132 | const env = process.platform === 'linux' 133 | ? { ...process.env, DISPLAY: process.env.DISPLAY || ':0', DBUS_SESSION_BUS_ADDRESS: '', ...envVars } > 134 | : { ...process.env, ...envVars }; 135 | 136 | // Get the electron executable path

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.0.145

5 findings
HIGH env-spread: cli.js:122 semgrep

Spreading entire process.env into an object — may capture all secrets 120 | }; 121 | const env = process.platform === 'linux' > 122 | ? { ...process.env, DISPLAY: process.env.DISPLAY || ':0', DBUS_SESSION_BUS_ADDRESS: '', ...envVars } 123 | : { ...process.env, ...envVars }; 124 | // Get the electron executable path

HIGH env-spread: cli.js:123 semgrep

Spreading entire process.env into an object — may capture all secrets 121 | const env = process.platform === 'linux' 122 | ? { ...process.env, DISPLAY: process.env.DISPLAY || ':0', DBUS_SESSION_BUS_ADDRESS: '', ...envVars } > 123 | : { ...process.env, ...envVars }; 124 | // Get the electron executable path 125 | let electronPath;

HIGH env-spread: cli.ts:133 semgrep

Spreading entire process.env into an object — may capture all secrets 131 | 132 | const env = process.platform === 'linux' > 133 | ? { ...process.env, DISPLAY: process.env.DISPLAY || ':0', DBUS_SESSION_BUS_ADDRESS: '', ...envVars } 134 | : { ...process.env, ...envVars }; 135 |

HIGH env-spread: cli.ts:134 semgrep

Spreading entire process.env into an object — may capture all secrets 132 | const env = process.platform === 'linux' 133 | ? { ...process.env, DISPLAY: process.env.DISPLAY || ':0', DBUS_SESSION_BUS_ADDRESS: '', ...envVars } > 134 | : { ...process.env, ...envVars }; 135 | 136 | // Get the electron executable path

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.0.144

5 findings
HIGH env-spread: cli.js:120 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/BobFrankston/msgview/blob/b1801db81856982f524405b39f61e9c69197dc6c/cli.js#L120 118 | }; 119 | const env = process.platform === 'linux' > 120 | ? { ...process.env, DISPLAY: process.env.DISPLAY || ':0', DBUS_SESSION_BUS_ADDRESS: '', ...envVars } 121 | : { ...process.env, ...envVars }; 122 | // Get the electron executable path

HIGH env-spread: cli.js:121 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/BobFrankston/msgview/blob/b1801db81856982f524405b39f61e9c69197dc6c/cli.js#L121 119 | const env = process.platform === 'linux' 120 | ? { ...process.env, DISPLAY: process.env.DISPLAY || ':0', DBUS_SESSION_BUS_ADDRESS: '', ...envVars } > 121 | : { ...process.env, ...envVars }; 122 | // Get the electron executable path 123 | let electronPath;

HIGH env-spread: cli.ts:131 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/BobFrankston/msgview/blob/b1801db81856982f524405b39f61e9c69197dc6c/cli.ts#L131 129 | 130 | const env = process.platform === 'linux' > 131 | ? { ...process.env, DISPLAY: process.env.DISPLAY || ':0', DBUS_SESSION_BUS_ADDRESS: '', ...envVars } 132 | : { ...process.env, ...envVars }; 133 |

HIGH env-spread: cli.ts:132 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/BobFrankston/msgview/blob/b1801db81856982f524405b39f61e9c69197dc6c/cli.ts#L132 130 | const env = process.platform === 'linux' 131 | ? { ...process.env, DISPLAY: process.env.DISPLAY || ':0', DBUS_SESSION_BUS_ADDRESS: '', ...envVars } > 132 | : { ...process.env, ...envVars }; 133 | 134 | // Get the electron executable path

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.0.143

2 findings
HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: bobfrankston.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.0.142

2 findings
HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: bobfrankston.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.0.141

2 findings
HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: bobfrankston.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.0.140

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.0.139

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.0.138

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.0.137

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.0.136

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.0.135

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.0.134

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.0.133

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.0.132

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.0.131

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.0.130

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.0.129

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.0.128

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.0.127

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.0.126

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.0.125

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.0.124

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.0.123

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.0.122

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.0.121

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.0.120

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.0.119

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.0.118

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.0.117

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.0.116

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.0.115

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.0.114

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.0.113

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.0.112

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.0.111

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.0.110

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.0.109

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.0.108

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.0.107

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.0.106

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.0.105

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.0.104

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.0.103

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.