@codingame/monaco-vscode-e4d0fd26-1b26-5583-b3f7-582e08d7b389-common
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| publish-pattern | dormant-publish | AI (publish-pattern): CodinGame publishes in batches; dormancy reflects release cadence, not account takeover. | ai | |
| publish-pattern | new-deps-added | AI (publish-pattern): New dep follows identical UUID naming convention, pinned to same version — internal package split pattern. | ai | |
| provenance | no-provenance | AI (provenance): CodinGame consistently publishes without provenance; stable false positive for this package family. | ai | |
| dependencies | unvetted-dep:@codingame/monaco-vscode-bb83fe45-f4c7-5673-b9f1-5c409a63f19c-common | AI (dependencies): Sibling package from same CodinGame monorepo; unvetted only because it hasn't been reviewed yet, not a risk. | ai | |
| dependencies | unvetted-dep:@codingame/monaco-vscode-bc8c28cd-7a80-54a9-af1a-e6b1e7a7f34a-common | AI (dependencies): Sibling package from same CodinGame monorepo; unvetted only because it hasn't been reviewed yet, not a risk. | ai |
Versions (showing 16 of 16)
| Version | Deps | Published |
|---|---|---|
| 23.3.0 | 13 / 0 | |
| 23.2.2 | 13 / 0 | |
| 23.2.1 | 13 / 0 | |
| 23.2.0 | 13 / 0 | |
| 23.1.1 | 13 / 0 | |
| 23.1.0 | 13 / 0 | |
| 23.0.4 | 13 / 0 | |
| 23.0.3 | 13 / 0 | |
| 23.0.2 | 13 / 0 | |
| 23.0.1 | 13 / 0 | |
| 23.0.0 | 13 / 0 | |
| 22.1.9 | 15 / 0 | |
| 22.1.8 | 15 / 0 | |
| 22.1.7 | 15 / 0 | |
| 22.1.6 | 15 / 0 | |
| 22.1.5 | 15 / 0 |
v23.3.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v23.2.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v23.2.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v23.2.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v23.1.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v23.1.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v23.0.4
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v23.0.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v23.0.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v23.0.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v23.0.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v22.1.9
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v22.1.8
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v22.1.7
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v22.1.6
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v22.1.5
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.