@camunda/copilot-chat
Camunda Copilot Client Library - React components and utilities for Camunda Platform 8
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| provenance | missing-githead | AI (provenance): Camunda org package published via GitHub Actions; missing gitHead reflects CI config change, not a supply-chain risk. | ai | |
| source-diff | obfuscated-file:dist/index-DmdrqaPH.mjs | AI (source-diff): Minified CodeMirror language parser; standard build output. | ai | |
| source-diff | obfuscated-file:dist/index-CxSI7FWR.mjs | AI (source-diff): Minified CodeMirror language parser; standard build output. | ai | |
| source-diff | obfuscated-file:dist/index-CHPRBFhT.mjs | AI (source-diff): Minified CodeMirror language parser; standard build output. | ai | |
| source-diff | obfuscated-file:dist/index-CBoGGa8H.mjs | AI (source-diff): Minified CodeMirror language parser; standard build output. | ai | |
| source-diff | obfuscated-file:dist/index-C8sQLK5p.mjs | AI (source-diff): Minified CodeMirror language parser; standard build output. | ai | |
| source-diff | obfuscated-file:dist/index-B_v_FN5L.mjs | AI (source-diff): Minified CodeMirror CSS language parser; standard build output. | ai | |
| source-diff | obfuscated-file:dist/index-C43OHv6l.mjs | AI (source-diff): Minified CodeMirror language parser; standard build output. | ai | |
| source-diff | obfuscated-file:dist/index-C1jLS8Or.mjs | AI (source-diff): Minified CodeMirror JS/TS language parser; standard build output. | ai | |
| source-diff | obfuscated-file:dist/index-C-wyVQAE.mjs | AI (source-diff): Minified CodeMirror language parser; standard build output. | ai | |
| source-diff | obfuscated-file:dist/index-Boabw8_p.mjs | AI (source-diff): Minified CodeMirror SCSS/CSS language parser; standard build output. | ai | |
| source-diff | obfuscated-file:dist/index-BDO93Wfp.mjs | AI (source-diff): Minified CodeMirror language parser; standard build output. | ai | |
| source-diff | obfuscated-file:dist/index-BCYU6ao6.mjs | AI (source-diff): Minified CodeMirror HTML/mixed language parser; standard build output. | ai | |
| source-diff | obfuscated-file:dist/index-BvOoeB_X.mjs | AI (source-diff): Minified CodeMirror XML language parser; standard build artifact. | ai | |
| source-diff | obfuscated-file:dist/index-BZylef8t.mjs | AI (source-diff): Minified CodeMirror language bundle; standard build artifact. | ai | |
| source-diff | obfuscated-file:dist/index-C2BPUXNG.mjs | AI (source-diff): Minified CodeMirror language bundle; standard build artifact. | ai | |
| source-diff | obfuscated-file:dist/index-CNSMHaJL.mjs | AI (source-diff): Minified CodeMirror language bundle; standard build artifact. | ai | |
| source-diff | obfuscated-file:dist/index-CYJusi0T.mjs | AI (source-diff): Minified CodeMirror language bundle; standard build artifact. | ai | |
| source-diff | obfuscated-file:dist/index-61nyxvLt.mjs | AI (source-diff): Minified CodeMirror C++ language parser; standard build artifact. | ai | |
| source-diff | obfuscated-file:dist/index-9DDv9i4k.mjs | AI (source-diff): Minified CodeMirror JS language parser; standard build artifact. | ai | |
| source-diff | obfuscated-file:dist/index-BFfuxTl0.mjs | AI (source-diff): Minified CodeMirror HTML language mode; standard build artifact. | ai | |
| source-diff | obfuscated-file:dist/index-BN1g2LCp.mjs | AI (source-diff): Minified CodeMirror CSS language parser; standard build artifact. | ai | |
| source-diff | obfuscated-file:dist/index-BsJOd3yN.mjs | AI (source-diff): Minified CodeMirror template language mode; standard build artifact. | ai | |
| source-diff | obfuscated-file:dist/index-BP4d_XM8.mjs | AI (source-diff): Vite-bundled CodeMirror language parser; minified but not malicious. | ai | |
| source-diff | obfuscated-file:dist/index-B-5TPQ8A.mjs | AI (source-diff): Vite-bundled CodeMirror template language grammar; minified but not malicious. | ai | |
| source-diff | obfuscated-file:dist/index-4sa8V10p.mjs | AI (source-diff): Vite-bundled CodeMirror HTML/CSS/JS language support; minified but not malicious. | ai | |
| source-diff | obfuscated-file:dist/index-2b0AN-Sm.mjs | AI (source-diff): Vite-bundled CodeMirror language parser; minified but not malicious. | ai | |
| source-diff | obfuscated-file:dist/index-0OL6F4q8.mjs | AI (source-diff): Vite-bundled CodeMirror PHP language grammar; minified but not malicious. | ai | |
| source-diff | obfuscated-file:dist/index-DeT4a01O.mjs | AI (source-diff): Vite-bundled CodeMirror language module; minified but not malicious. | ai | |
| source-diff | obfuscated-file:dist/index-D8hYztB7.mjs | AI (source-diff): Vite-bundled CodeMirror language module; minified but not malicious. | ai | |
| source-diff | obfuscated-file:dist/index-D0G717xH.mjs | AI (source-diff): Vite-bundled CodeMirror JS/TS language support; minified but not malicious. | ai | |
| source-diff | obfuscated-file:dist/index-CWHzMlNI.mjs | AI (source-diff): Vite-bundled CodeMirror language module; minified but not malicious. | ai | |
| source-diff | obfuscated-file:dist/index-CT4z-F-Z.mjs | AI (source-diff): Vite-bundled CodeMirror language module; minified but not malicious. | ai | |
| source-diff | obfuscated-file:dist/index-BYd8n6VK.mjs | AI (source-diff): Vite-bundled CodeMirror template language grammar; minified but not malicious. | ai | |
| source-diff | obfuscated-file:dist/index-CbWcd8SU.mjs | AI (source-diff): Minified CodeMirror language bundle; standard build artifact. | ai | |
| source-diff | obfuscated-file:dist/index-ClKC5rTq.mjs | AI (source-diff): Minified CodeMirror language bundle; standard build artifact. | ai | |
| source-diff | obfuscated-file:dist/index-CpYCnt6J.mjs | AI (source-diff): Main minified bundle for Camunda Copilot React library; standard build artifact. | ai | |
| source-diff | net-exec-file:dist/index-CpYCnt6J.mjs | AI (source-diff): React UI library main bundle; network calls to Camunda API and dynamic imports are expected behavior. | ai | |
| source-diff | obfuscated-file:dist/index-CqsdymaR.mjs | AI (source-diff): Minified CodeMirror language bundle; standard build artifact. | ai | |
| source-diff | obfuscated-file:dist/index-CsVeGp0g.mjs | AI (source-diff): Minified CodeMirror language bundle; standard build artifact. | ai | |
| source-diff | obfuscated-file:dist/index-CtupqmAo.mjs | AI (source-diff): Minified CodeMirror language bundle; standard build artifact. | ai | |
| source-diff | obfuscated-file:dist/index-BIjERx7K.mjs | AI (source-diff): Minified CodeMirror XML/HTML language mode; standard build artifact. | ai | |
| source-diff | obfuscated-file:dist/index-Bdt3qQMb.mjs | AI (source-diff): Minified CodeMirror Java language mode; standard build artifact. | ai | |
| source-diff | obfuscated-file:dist/index-5N2HZxTo.mjs | AI (source-diff): Minified CodeMirror language parser; standard build artifact. | ai | |
| source-diff | obfuscated-file:dist/index-BqQH4kuL.mjs | AI (source-diff): Minified CodeMirror C++ language mode; standard build artifact. | ai | |
| source-diff | obfuscated-file:dist/index-C_4Z1BOo.mjs | AI (source-diff): Minified CodeMirror CSS language mode; standard build artifact. | ai | |
| source-diff | obfuscated-file:dist/index-C2YCozva.mjs | AI (source-diff): Minified CodeMirror Jinja2/template language mode; standard build artifact. | ai | |
| source-diff | obfuscated-file:dist/index-CRB0UBa2.mjs | AI (source-diff): Minified CodeMirror module; standard bundler output. | ai | |
| source-diff | obfuscated-file:dist/index--BxDoZF9.mjs | AI (source-diff): Minified CodeMirror template parser; standard bundler output. | ai | |
| source-diff | obfuscated-file:dist/index--XA6rVTe.mjs | AI (source-diff): Minified CodeMirror parser module; standard bundler output. | ai | |
| source-diff | obfuscated-file:dist/index-A2-oYBDG.mjs | AI (source-diff): Minified CodeMirror CSS parser; standard bundler output. | ai | |
| source-diff | obfuscated-file:dist/index-B6CwfTEa.mjs | AI (source-diff): Minified CodeMirror CSS language module; standard bundler output. | ai | |
| source-diff | obfuscated-file:dist/index-B6Ya3Gu5.mjs | AI (source-diff): Minified CodeMirror CSS module; standard bundler output. | ai | |
| source-diff | obfuscated-file:dist/index-C0we7KB8.mjs | AI (source-diff): Minified CodeMirror language module; standard bundler output. | ai | |
| source-diff | obfuscated-file:dist/index-CBGL4OvF.mjs | AI (source-diff): Minified CodeMirror module; standard bundler output. | ai | |
| source-diff | obfuscated-file:dist/index-BGGZNrRl.mjs | AI (source-diff): Minified CodeMirror language support bundle; standard build artifact. | ai | |
| source-diff | obfuscated-file:dist/index-BSHG_DM8.mjs | AI (source-diff): Minified CodeMirror language support bundle; standard build artifact. | ai | |
| source-diff | obfuscated-file:dist/index-C475hKkO.mjs | AI (source-diff): Minified CodeMirror CSS language support; standard build artifact. | ai | |
| source-diff | obfuscated-file:dist/index-C9zW6Z2_.mjs | AI (source-diff): Minified CodeMirror CSS completion source; standard build artifact. | ai | |
| source-diff | obfuscated-file:dist/index-CoA9dcx3.mjs | AI (source-diff): Minified CodeMirror language support bundle; standard build artifact. | ai | |
| source-diff | obfuscated-file:dist/index-CscYHy6h.mjs | AI (source-diff): Minified CodeMirror language support bundle; standard build artifact. | ai | |
| source-diff | obfuscated-file:dist/index-Cw-SuhdT.mjs | AI (source-diff): Minified CodeMirror language support bundle; standard build artifact. | ai | |
| source-diff | obfuscated-file:dist/index-DOLNMxFu.mjs | AI (source-diff): Minified CodeMirror language support bundle; standard build artifact. | ai | |
| source-diff | obfuscated-file:dist/index-_I5fuzUF.mjs | AI (source-diff): Minified CodeMirror language support bundle; standard build artifact. | ai | |
| source-diff | obfuscated-file:dist/index-BnmtgV0w.mjs | AI (source-diff): Minified CodeMirror Go language bundle. | ai | |
| source-diff | obfuscated-file:dist/index-AivoqCYI.mjs | AI (source-diff): Minified CodeMirror language parser bundle; single-char variable names are standard minifier output. | ai | |
| source-diff | obfuscated-file:dist/index-Bf-TzYoX.mjs | AI (source-diff): Minified CodeMirror CSS language bundle. | ai | |
| source-diff | obfuscated-file:dist/index-BD9akzuz.mjs | AI (source-diff): Minified CodeMirror language parser bundle. | ai | |
| source-diff | obfuscated-file:dist/index-DBZC7i5Q.mjs | AI (source-diff): Minified CodeMirror language bundle. | ai | |
| source-diff | obfuscated-file:dist/index-D2DQ-6Kg.mjs | AI (source-diff): Minified CodeMirror language bundle. | ai | |
| source-diff | obfuscated-file:dist/index-D-HvGO3l.mjs | AI (source-diff): 1.7MB CodeMirror runtime bundle; minification triggers obfuscation heuristic. | ai | |
| source-diff | obfuscated-file:dist/index-CEeysD_n.mjs | AI (source-diff): Minified CodeMirror language bundle. | ai | |
| source-diff | obfuscated-file:dist/index-C6BC_ifh.mjs | AI (source-diff): Minified CodeMirror language bundle; same pattern as other dist chunks. | ai | |
| source-diff | obfuscated-file:dist/index-C2u08OyP.mjs | AI (source-diff): Minified CodeMirror Java language bundle. | ai | |
| source-diff | obfuscated-file:dist/index-C-emmmY5.mjs | AI (source-diff): Minified CodeMirror language parser bundle. | ai | |
| source-diff | obfuscated-file:dist/index-97e22ogj.mjs | AI (source-diff): Minified CodeMirror HTML/CSS/JS language support; standard build artifact. | ai | |
| source-diff | obfuscated-file:dist/index-2C7t0U-r.mjs | AI (source-diff): Minified CodeMirror parser module; standard build artifact. | ai | |
| source-diff | obfuscated-file:dist/index-CHo3ukZw.mjs | AI (source-diff): Minified CodeMirror language module; standard build artifact. | ai | |
| source-diff | obfuscated-file:dist/index-CNW0wFbF.mjs | AI (source-diff): Minified CodeMirror language module; standard build artifact. | ai | |
| source-diff | obfuscated-file:dist/index-CwfpKJ4c.mjs | AI (source-diff): Minified CodeMirror language module; standard build artifact. | ai | |
| source-diff | obfuscated-file:dist/index-Cwn6OPyC.mjs | AI (source-diff): Minified CodeMirror JS/TS language module; standard build artifact. | ai | |
| source-diff | obfuscated-file:dist/index-Cxlreb4X.mjs | AI (source-diff): Minified CodeMirror language module; standard build artifact. | ai | |
| source-diff | obfuscated-file:dist/index-BJYPKXMU.mjs | AI (source-diff): Minified CodeMirror template language module; standard build artifact. | ai | |
| source-diff | obfuscated-file:dist/index-B89ciBvl.mjs | AI (source-diff): Minified CodeMirror PHP language grammar; standard build artifact. | ai | |
| source-diff | obfuscated-file:dist/index-BNtk2hIU.mjs | AI (source-diff): Minified CodeMirror Java language grammar; standard build artifact. | ai | |
| source-diff | obfuscated-file:dist/index-5JRdgV3D.mjs | AI (source-diff): Minified CodeMirror language module; standard build artifact. | ai | |
| source-diff | obfuscated-file:dist/index-BljerkkH.mjs | AI (source-diff): Minified CodeMirror Java language bundle. | ai | |
| source-diff | obfuscated-file:dist/index-BspnobjW.mjs | AI (source-diff): Minified CodeMirror CSS language bundle. | ai | |
| source-diff | obfuscated-file:dist/index-CoBD3JP3.mjs | AI (source-diff): Minified CodeMirror language bundle; standard build artifact. | ai | |
| source-diff | obfuscated-file:dist/index-CFVS5psP.mjs | AI (source-diff): Large CodeMirror/lezer runtime; minification triggers rule but content is legitimate parser infrastructure. | ai | |
| source-diff | obfuscated-file:dist/index-BzQx0g-S.mjs | AI (source-diff): Minified CodeMirror language bundle; standard build artifact. | ai | |
| source-diff | obfuscated-file:dist/index-BsAzfFID.mjs | AI (source-diff): Minified CodeMirror language bundle; part of standard Vite build output. | ai | |
| source-diff | obfuscated-file:dist/index-BoHrWn4U.mjs | AI (source-diff): Minified CodeMirror template language bundle. | ai | |
| source-diff | obfuscated-file:dist/index-Bo9ApYYN.mjs | AI (source-diff): Minified CodeMirror Go language bundle. | ai | |
| source-diff | obfuscated-file:dist/index-BjyHfjEa.mjs | AI (source-diff): Minified CodeMirror Jinja/template language bundle. | ai | |
| source-diff | obfuscated-file:dist/index-BbhTSloX.mjs | AI (source-diff): Minified CodeMirror HTML/CSS/JS language bundle. | ai | |
| source-diff | obfuscated-file:dist/index-B0VVkMg4.mjs | AI (source-diff): Minified CodeMirror PHP language bundle; recognizable parser tables. | ai | |
| source-diff | obfuscated-file:dist/index-CS1zZ4Sb.mjs | AI (source-diff): Minified CodeMirror language bundle; standard build artifact. | ai | |
| source-diff | net-exec-file:dist/index-CFVS5psP.mjs | AI (source-diff): CodeMirror runtime bundle; dynamic eval/import is part of lezer parser infrastructure, not dropper behavior. | ai | |
| source-diff | obfuscated-file:dist/index-CaL59XOS.mjs | AI (source-diff): Minified CodeMirror module; standard build output for this package. | ai | |
| source-diff | obfuscated-file:dist/index-CSxmgXvA.mjs | AI (source-diff): Minified CodeMirror module; standard build output for this package. | ai | |
| source-diff | obfuscated-file:dist/index-CthuG_3E.mjs | AI (source-diff): Minified CodeMirror module; standard build output for this package. | ai | |
| source-diff | obfuscated-file:dist/index-CTX5Rvql.mjs | AI (source-diff): Minified CodeMirror module; standard build output for this package. | ai | |
| source-diff | obfuscated-file:dist/index-DLr4ZBPg.mjs | AI (source-diff): Minified CodeMirror module; standard build output for this package. | ai | |
| source-diff | obfuscated-file:dist/index-BQorEvFo.mjs | AI (source-diff): Minified CodeMirror Go language module; standard build output. | ai | |
| source-diff | obfuscated-file:dist/index-Bl5v7nc4.mjs | AI (source-diff): Minified CodeMirror HTML/template language module; standard build output. | ai | |
| source-diff | obfuscated-file:dist/index-BJXvrp0M.mjs | AI (source-diff): Minified CodeMirror JavaScript language module; standard build output. | ai | |
| source-diff | obfuscated-file:dist/index-B1z02epO.mjs | AI (source-diff): Minified CodeMirror CSS completion module; standard build output. | ai | |
| source-diff | obfuscated-file:dist/index-BZuiwpju.mjs | AI (source-diff): Minified CodeMirror PHP language module; standard build output. | ai | |
| source-diff | obfuscated-file:dist/index-C3N8idok.mjs | AI (source-diff): Minified CodeMirror C++ language module; standard build output. | ai | |
| source-diff | obfuscated-file:dist/index-D-6VhvRc.mjs | AI (source-diff): Minified CodeMirror bundle; standard build artifact. | ai | |
| source-diff | obfuscated-file:dist/index-CU57HSN0.mjs | AI (source-diff): Minified CodeMirror bundle; standard build artifact. | ai | |
| source-diff | obfuscated-file:dist/index-C7m8mJGS.mjs | AI (source-diff): Minified CodeMirror bundle; standard build artifact. | ai | |
| source-diff | obfuscated-file:dist/index-C7CvJzpL.mjs | AI (source-diff): Minified CodeMirror bundle; standard build artifact. | ai | |
| source-diff | obfuscated-file:dist/index-BQIivoG-.mjs | AI (source-diff): Minified CodeMirror Java language mode; standard build artifact. | ai | |
| source-diff | obfuscated-file:dist/index-B355G1UU.mjs | AI (source-diff): Vite-bundled React/Carbon UI component; minified but readable and benign. | ai | |
| source-diff | net-exec-file:dist/index-B355G1UU.mjs | AI (source-diff): Network calls are React fetch-based chat API calls; no dynamic code execution pattern. | ai | |
| source-diff | obfuscated-file:dist/index-by4zxE4d.mjs | AI (source-diff): Minified CodeMirror bundle; standard build artifact. | ai | |
| source-diff | obfuscated-file:dist/index-B6q3V5m4.mjs | AI (source-diff): Minified CodeMirror parser; standard build artifact. | ai | |
| source-diff | obfuscated-file:dist/index-B746dlvf.mjs | AI (source-diff): Minified CodeMirror CSS language mode; standard build artifact. | ai | |
| source-diff | obfuscated-file:dist/index-BhgnbPby.mjs | AI (source-diff): Minified CodeMirror XML/HTML mode; standard build artifact. | ai | |
| source-diff | obfuscated-file:dist/index-B3ROc4gX.mjs | AI (source-diff): Minified CodeMirror CSS language parser; standard build artifact. | ai | |
| source-diff | obfuscated-file:dist/index-0aAGlcdj.mjs | AI (source-diff): Minified CodeMirror parser bundle; standard build artifact. | ai | |
| source-diff | source-size-tripled | AI (source-diff): Size increase reflects addition of CodeMirror editor with many language modes; legitimate feature expansion. | ai | |
| source-diff | obfuscated-file:dist/cobol-BlTKFDRj.mjs | AI (source-diff): Minified CodeMirror language mode for COBOL; standard build artifact. | ai | |
| source-diff | obfuscated-file:dist/gherkin-CJuwpceU.mjs | AI (source-diff): Minified CodeMirror language mode for Gherkin; standard build artifact. | ai | |
| source-diff | large-new-source-files | AI (source-diff): Large file count reflects CodeMirror multi-language editor bundle; expected for this package. | ai | |
| source-diff | obfuscated-file:dist/index-DIrqUpx2.mjs | AI (source-diff): Minified CodeMirror language bundle; standard build artifact. | ai | |
| source-diff | obfuscated-file:dist/index-DAWX2JVg.mjs | AI (source-diff): Minified CodeMirror language bundle; standard build artifact. | ai | |
| source-diff | obfuscated-file:dist/index-CVx5wSTQ.mjs | AI (source-diff): Minified CodeMirror language bundle; standard build artifact. | ai | |
| source-diff | obfuscated-file:dist/index-CvIgzf-J.mjs | AI (source-diff): Minified CodeMirror language bundle; standard build artifact. | ai | |
| source-diff | obfuscated-file:dist/index-CUB2RS-e.mjs | AI (source-diff): Minified CodeMirror language bundle; standard build artifact. | ai | |
| source-diff | obfuscated-file:dist/index-CkVQhuBh.mjs | AI (source-diff): Minified CodeMirror PHP language parser; standard build artifact. | ai | |
| source-diff | obfuscated-file:dist/index-CInspQct.mjs | AI (source-diff): Minified CodeMirror HTML/mixed language parser; standard build artifact. | ai | |
| source-diff | obfuscated-file:dist/index-BYD5i1_w.mjs | AI (source-diff): Minified CodeMirror language parser; standard build artifact. | ai | |
| source-diff | obfuscated-file:dist/index-BV3R9jZ7.mjs | AI (source-diff): Minified CodeMirror Go language parser; standard build artifact. | ai |
Versions (showing 48 of 48)
| Version | Deps | Published |
|---|---|---|
| 0.7.0 | 1 / 3 | |
| 0.6.0 | 1 / 1 | |
| 0.5.11 | 1 / 1 | |
| 0.5.10 | 1 / 1 | |
| 0.5.9 | 1 / 1 | |
| 0.5.8 | 1 / 1 | |
| 0.5.7 | 1 / 1 | |
| 0.5.6 | 1 / 1 | |
| 0.5.5 | 1 / 1 | |
| 0.5.4 | 1 / 1 | |
| 0.5.3 | 1 / 1 | |
| 0.5.2 | 1 / 1 | |
| 0.5.1 | 1 / 1 | |
| 0.5.0 | 1 / 1 | |
| 0.4.21 | 1 / 1 | |
| 0.4.20 | 1 / 1 | |
| 0.4.19 | 1 / 1 | |
| 0.4.18 | 1 / 1 | |
| 0.4.17 | 1 / 1 | |
| 0.4.16 | 1 / 1 | |
| 0.4.15 | 1 / 1 | |
| 0.4.14 | 1 / 1 | |
| 0.4.13 | 1 / 1 | |
| 0.4.12 | 1 / 1 | |
| 0.4.11 | 1 / 1 | |
| 0.4.10 | 1 / 1 | |
| 0.4.9 | 1 / 1 | |
| 0.4.8 | 1 / 1 | |
| 0.4.7 | 1 / 1 | |
| 0.4.6 | 1 / 1 | |
| 0.4.5 | 1 / 1 | |
| 0.4.4 | 1 / 1 | |
| 0.4.3 | 1 / 1 | |
| 0.4.2 | 2 / 0 | |
| 0.4.1 | 2 / 0 | |
| 0.4.0 | 2 / 0 | |
| 0.3.2 | 1 / 0 | |
| 0.3.1 | 1 / 0 | |
| 0.3.0 | 1 / 0 | |
| 0.2.2 | 1 / 0 | |
| 0.2.1 | 1 / 0 | |
| 0.2.0 | 1 / 0 | |
| 0.1.3 | 1 / 0 | |
| 0.1.1 | 1 / 0 | |
| 0.1.0 | 1 / 0 | |
| 0.0.3 | 1 / 1 | |
| 0.0.2 | 1 / 1 | |
| 0.0.1 | 1 / 1 |
v0.7.0
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: GitHub Actions.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.6.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.5.11
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.5.10
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.5.9
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.5.8
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.5.7
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.5.6
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.5.5
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.5.4
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.5.3
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.5.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.5.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.5.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.4.21
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.4.20
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.4.19
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.4.18
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.4.17
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.4.16
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.4.15
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.4.14
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.4.13
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.4.12
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.4.11
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.4.10
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.4.9
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.4.8
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.4.7
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.4.6
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.4.5
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.4.4
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.4.3
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.4.2
13 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.4.1
16 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.4.0
15 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.3.2
14 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.3.1
14 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.3.0
16 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.2.2
14 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.2.1
14 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.2.0
12 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.1.3
15 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.1.1
11 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.1.0
14 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.3
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.0.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.