@c8y/hybrid
9
Versions
Apache-2.0
License
No
Install Scripts
Missing
Provenance
Supply chain provenance
Status for the latest visible version.
No SLSA provenance
npm registry signatures
No source commit
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
c8y
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| publish-pattern | new-deps-added | AI (publish-pattern): @angular/animations is a standard Angular core package; benign addition for this Angular hybrid library. | ai | |
| phantom-deps | phantom-dep:@angular/animations | AI (phantom-deps): Angular framework packages are commonly loaded by convention rather than direct import; stable false positive for this package. | ai | |
| provenance | no-provenance | AI (provenance): Published via GitHub Actions; org-wide pattern of no Sigstore attestation. | ai | |
| dependencies | unvetted-dep:angular | AI (dependencies): @c8y/hybrid is an Angular/AngularJS hybrid package; angular 1.8.3 is an expected and intentional dependency. | ai | |
| npm-metadata | no-description | AI (npm-metadata): Consistent across @c8y/* packages; not indicative of malice. | ai | |
| bogus-package | bogus-package | AI (bogus-package): Established @c8y org package with 456 versions; sparse metadata is a consistent pattern across the org, not a spam indicator. | ai | |
| phantom-deps | phantom-dep:rxjs | AI (phantom-deps): Framework package; rxjs is a peer/transitive dep loaded by convention, not direct import. | ai | |
| phantom-deps | phantom-dep:ngx-bootstrap | AI (phantom-deps): Referenced in config files; loaded by convention in this platform package. | ai | |
| phantom-deps | phantom-dep:angular | AI (phantom-deps): AngularJS loaded by convention in hybrid Angular/AngularJS setup. | ai | |
| phantom-deps | phantom-dep:@c8y/style | AI (phantom-deps): Same-org sibling dep; referenced in config, not direct import — expected pattern. | ai | |
| phantom-deps | phantom-dep:@c8y/client | AI (phantom-deps): Same-org sibling dep; referenced in config, not direct import — expected pattern. | ai | |
| phantom-deps | phantom-dep:@angular/cdk | AI (phantom-deps): Framework-scoped package loaded by convention; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:monaco-editor | AI (phantom-deps): Referenced in config files; loaded by convention in this platform package. | ai |
Versions (showing 9 of 9)
| Version | Deps | Published |
|---|---|---|
| 1024.0.0 | 13 / 2 | |
| 1023.80.0 | 11 / 2 | |
| 1023.76.0 | 11 / 2 | |
| 1023.14.173 | 12 / 2 | |
| 1023.14.152 | 11 / 2 | |
| 1023.14.132 | 11 / 2 | |
| 1023.7.0 | 11 / 2 | |
| 1021.22.164 | 11 / 2 | |
| 1021.22.161 | 11 / 2 |
v1024.0.0
1 finding
INFO
No provenance attestation
provenance
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.