@bts-soft/notifications
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| phantom-deps | phantom-dep:@types/node-telegram-bot-api | AI (phantom-deps): Type-only package; not directly imported at runtime by design. | ai | |
| phantom-deps | phantom-dep:typescript | AI (phantom-deps): Compiler dependency; not directly imported but required for build. | ai | |
| phantom-deps | phantom-dep:@nestjs/core | AI (phantom-deps): NestJS peer dependency loaded by framework convention, not direct import. | ai | |
| phantom-deps | phantom-dep:@nestjs/config | AI (phantom-deps): NestJS peer dependency loaded by framework convention, not direct import. | ai | |
| semgrep | semgrep:dynamic-require | AI (semgrep): require() loads a user-configured service account file path — standard Firebase Admin SDK pattern, not arbitrary module loading. | ai | |
| phantom-deps | phantom-dep:ts-node | AI (phantom-deps): Build/runtime tool dependency for NestJS; not directly imported but used by convention. | ai | |
| source-diff | large-new-source-files | AI (source-diff): 50 new files consistent with added test suite and feature expansion; no obfuscation or injected code indicators. | ai | |
| dependencies | unvetted-dep:typeorm-transactional | AI (dependencies): Well-known TypeORM transaction helper; expected for a NestJS module using TypeORM. | ai | |
| dependencies | unvetted-dep:node-telegram-bot-api | AI (dependencies): Legitimate Telegram bot library; expected dependency for a notifications module with Telegram support. | ai |
Versions (showing 4 of 4)
| Version | Deps | Published |
|---|---|---|
| 1.5.1 | 14 / 13 | |
| 1.4.5 | 15 / 8 | |
| 1.4.2 | 17 / 5 | |
| 1.0.1 | 7 / 2 |
v1.5.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.4.5
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.4.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.