@camunda/linting

[Reject — re-review on republish] (prior reject: AI (bogus-package): SPAM-FLAGGED publisher with 20 rejections; empty entry point indicates account compromise or malicious intent.) Matched 2 signal(s), weighted score 4: • [S_KNOWN_SPAM_PUBLISHER] Maintainer(s) previously flagged as spam: barinali. • [S_EMPTY_MAIN] Entry point (index.js) is 38 bytes — effectively empty.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

[Reject — re-review on republish] (prior reject: AI (bogus-package): SPAM-FLAGGED publisher with 20 rejections; empty entry point indicates account compromise or malicious intent.) Matched 2 signal(s), weighted score 4: • [S_KNOWN_SPAM_PUBLISHER] Maintainer(s) previously flagged as spam: jarekdanielak, simon-steinruecken-camunda. • [S_EMPTY_MAIN] Entry point (index.js) is 38 bytes — effectively empty.

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

[Reject — re-review on republish] (prior reject: AI (bogus-package): SPAM-FLAGGED publisher with 20 rejections; empty entry point indicates account compromise or malicious intent.) Matched 2 signal(s), weighted score 4: • [S_KNOWN_SPAM_PUBLISHER] Maintainer(s) previously flagged as spam: jarekdanielak, simon-steinruecken-camunda. • [S_EMPTY_MAIN] Entry point (index.js) is 38 bytes — effectively empty.

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

[Reject — re-review on republish] (prior reject: AI (bogus-package): SPAM-FLAGGED publisher with 20 rejections; empty entry point indicates account compromise or malicious intent.) Matched 2 signal(s), weighted score 4: • [S_KNOWN_SPAM_PUBLISHER] Maintainer(s) previously flagged as spam: jarekdanielak, simon-steinruecken-camunda. • [S_EMPTY_MAIN] Entry point (index.js) is 38 bytes — effectively empty.

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

[Reject — re-review on republish] (prior reject: AI (bogus-package): SPAM-FLAGGED publisher with 20 rejections; empty entry point indicates account compromise or malicious intent.) Matched 2 signal(s), weighted score 4: • [S_KNOWN_SPAM_PUBLISHER] Maintainer(s) previously flagged as spam: jarekdanielak. • [S_EMPTY_MAIN] Entry point (index.js) is 38 bytes — effectively empty.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

[Reject — re-review on republish] (prior reject: AI (bogus-package): SPAM-FLAGGED publisher with 20 rejections; empty entry point indicates account compromise or malicious intent.) Matched 2 signal(s), weighted score 4: • [S_KNOWN_SPAM_PUBLISHER] Maintainer(s) previously flagged as spam: jarekdanielak. • [S_EMPTY_MAIN] Entry point (index.js) is 38 bytes — effectively empty.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account (barmac) than the most recent previously approved version (nikku) on 2025-03-03, but barmac is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account (barmac) than the most recent previously approved version (nikku) on 2025-02-24, but barmac is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account (nikku) than the most recent previously approved version (barmac) on 2025-02-20, but nikku is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account (nikku) than the most recent previously approved version (barmac) on 2025-02-20, but nikku is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account (barmac) than the most recent previously approved version (philippfromme) on 2024-11-25, but barmac is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

This version was published by a different npm account (misiekhardcore) than the most recent previously approved version (philippfromme) on 2024-11-18. It has since remained available on npm for 606 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account (philippfromme) than the most recent previously approved version (nikku) on 2024-10-24, but philippfromme is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account (philippfromme) than the most recent previously approved version (nikku) on 2024-10-11, but philippfromme is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account (nikku) than the most recent previously approved version (philippfromme) on 2024-09-19, but nikku is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account (philippfromme) than the most recent previously approved version (nikku) on 2024-09-09, but philippfromme is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account (philippfromme) than the most recent previously approved version (nikku) on 2024-08-27, but philippfromme is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account (nikku) than the most recent previously approved version (philippfromme) on 2024-08-22, but nikku is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account (philippfromme) than the most recent previously approved version (barmac) on 2024-08-01, but philippfromme is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account (barmac) than the most recent previously approved version (marstamm) on 2024-06-17, but barmac is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account (marstamm) than the most recent previously approved version (philippfromme) on 2024-05-24, but marstamm is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.