@certd/commercial-core — Greenflagged

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.

Maintainers

greper

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
dependencies	unvetted-dep:wechatpay-node-v3	AI (dependencies): Legitimate WeChat Pay SDK; appropriate for commercial billing features in this package.	ai	2026/05/21
dependencies	unvetted-dep:alipay-sdk	AI (dependencies): Legitimate Alipay payment SDK; appropriate for commercial billing features in this package.	ai	2026/05/21
provenance	no-provenance	AI (provenance): Provenance attestation is a best-practice signal, not a security blocker for established packages.	ai	2026/05/13
npm-metadata	no-description	AI (npm-metadata): Established package with 155 versions; missing description is metadata gap, not malware indicator.	ai	2026/05/13
dependencies	unvetted-dep:@midwayjs/logger	AI (dependencies): @midwayjs/logger is a core Midway.js framework package; stable false positive for this certd monorepo package.	ai	2026/05/09
phantom-deps	phantom-dep:wechatpay-node-v3	AI (phantom-deps): Declared as a runtime dep for payment integration; phantom-dep heuristic fires because it's not directly imported in this wrapper package.	ai	2026/05/09
bogus-package	bogus-package	AI (bogus-package): Established package with 152 versions and 568-day history; missing metadata is a style issue, not a spam/malware indicator.	ai	2026/05/02
phantom-deps	phantom-dep:dayjs	AI (phantom-deps): Monorepo package; dayjs declared as dep for consumers, not directly imported in this sub-package.	ai	2026/04/28
phantom-deps	phantom-dep:@midwayjs/typeorm	AI (phantom-deps): Framework config dep; stable pattern for this package.	ai	2026/04/28
phantom-deps	phantom-dep:@midwayjs/swagger	AI (phantom-deps): Framework config dep; stable pattern for this package.	ai	2026/04/28
phantom-deps	phantom-dep:@certd/plus-core	AI (phantom-deps): Same org scope; stable monorepo pattern.	ai	2026/04/28
phantom-deps	phantom-dep:@certd/pipeline	AI (phantom-deps): Same org scope; stable monorepo pattern.	ai	2026/04/28
phantom-deps	phantom-dep:@midwayjs/koa	AI (phantom-deps): Framework config dep; referenced in config files, not directly imported — stable pattern.	ai	2026/04/28
phantom-deps	phantom-dep:@certd/basic	AI (phantom-deps): Same org scope; declared for transitive consumer use, stable pattern across versions.	ai	2026/04/28

Versions (showing 51 of 98)

View all versions

Version	Deps	Published
1.41.1	11 / 21	2026-06-05
1.41.0	11 / 21	2026-06-04
1.40.5	11 / 21	2026-05-26
1.40.4	11 / 21	2026-05-24
1.40.3	11 / 21	2026-05-21
1.40.2	11 / 21	2026-05-19
1.40.1	11 / 21	2026-05-18
1.40.0	11 / 21	2026-05-14
1.39.16	11 / 21	2026-05-13
1.39.14	11 / 21	2026-05-11
1.39.13	11 / 21	2026-05-10
1.39.12	11 / 16	2026-04-29
1.39.11	11 / 16	2026-04-26
1.39.10	11 / 16	2026-04-11
1.39.9	11 / 16	2026-04-05
1.39.8	11 / 16	2026-03-31
1.39.7	11 / 16	2026-03-25
1.39.6	11 / 16	2026-03-22
1.39.5	11 / 16	2026-03-18
1.39.4	11 / 16	2026-03-17
1.39.3	11 / 16	2026-03-17
1.39.2	11 / 16	2026-03-16
1.39.1	10 / 16	2026-03-09
1.39.0	10 / 16	2026-03-07
1.38.12	10 / 16	2026-02-18
1.38.11	10 / 16	2026-02-16
1.38.10	10 / 16	2026-02-15
1.38.9	10 / 16	2026-02-09
1.38.8	10 / 16	2026-02-06
1.38.7	10 / 16	2026-02-05
1.38.6	10 / 16	2026-02-04
1.38.5	10 / 16	2026-02-02
1.38.4	10 / 16	2026-01-31
1.38.3	10 / 16	2026-01-28
1.38.2	10 / 16	2026-01-22
1.38.1	10 / 16	2026-01-15
1.38.0	10 / 16	2026-01-13
1.37.17	13 / 16	2025-12-29
1.37.16	13 / 16	2025-12-15
1.37.15	13 / 16	2025-12-06
1.37.14	13 / 16	2025-12-02
1.37.13	13 / 16	2025-12-02
1.37.12	13 / 16	2025-11-29
1.37.11	13 / 16	2025-11-28
1.37.10	13 / 16	2025-11-19
1.37.9	13 / 16	2025-11-19
1.37.8	13 / 16	2025-11-17
1.37.7	13 / 16	2025-11-12
1.37.6	13 / 16	2025-11-10
1.37.5	13 / 16	2025-11-08
1.37.4	13 / 16	2025-10-28

v1.41.1

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.41.0

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.40.5

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.40.4

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.40.3

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.40.2

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.40.1

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.40.0

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.39.16

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.39.14

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.39.13

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.39.12

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.39.11

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.39.10

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.39.9

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.39.8

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.39.7

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.39.6

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.39.5

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.39.4

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.39.3

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.39.2

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.39.1

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.39.0

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.38.12

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.38.11

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.38.10

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.38.9

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.38.8

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.38.7

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.38.6

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.38.5

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.38.4

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.38.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.38.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.38.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.38.0

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.37.17

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.37.16

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.37.15

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.37.14

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.37.13

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.37.12

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.37.11

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.37.10

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.37.9

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.37.8

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.37.7

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.37.6

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.37.5

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.37.4

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.