@checkstack/integration-jira-backend
12
Versions
—
License
No
Install Scripts
Missing
Provenance
Supply chain provenance
Status for the latest visible version.
No SLSA provenance
npm registry signatures
No source commit
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
enyineer
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| license | uncommon-license:Elastic-2.0 | AI (license): Elastic-2.0 is a known license used consistently across this package family. | ai | |
| provenance | no-provenance | AI (provenance): Consistent pattern across this org's packages; no other risk indicators present. | ai | |
| dependencies | unvetted-dep:@checkstack/automation-backend | AI (dependencies): Same-org @checkstack scope; consistent with publisher's established package ecosystem. | ai | |
| dependencies | unvetted-dep:@checkstack/integration-backend | AI (dependencies): Same-org @checkstack scope; consistent with publisher's established package ecosystem. | ai | |
| provenance | missing-githead | AI (provenance): Established publisher with clean track record; missing gitHead alone is not a malware signal for this package. | ai | |
| npm-metadata | no-description | AI (npm-metadata): Internal monorepo package; missing description is expected and stable across versions. | ai | |
| phantom-deps | phantom-dep:@checkstack/common | AI (phantom-deps): Same org scope workspace dependency; phantom-dep false positive for monorepo packages. | ai | |
| bogus-package | bogus-package | AI (bogus-package): Monorepo workspace package; missing metadata is expected for internal packages, not a spam/malware indicator. | ai | |
| phantom-deps | phantom-dep:@orpc/server | AI (phantom-deps): Declared as a dependency; phantom-dep heuristic fires because it's referenced in config rather than directly imported — stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:@checkstack/integration-common | AI (phantom-deps): Same-org scoped package; phantom-dep heuristic is a known false positive for org-internal shared libraries. | ai |