@colijnit/configurator
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| phantom-deps | phantom-dep:core-js | AI (phantom-deps): Runtime polyfill; stable implicit dependency for Angular packages. | ai | |
| phantom-deps | phantom-dep:ts-node | AI (phantom-deps): Build/config tool; stable implicit dependency for TypeScript projects. | ai | |
| phantom-deps | phantom-dep:zone.js | AI (phantom-deps): Angular runtime dependency; stable implicit dependency. | ai | |
| phantom-deps | phantom-dep:@angular/cdk | AI (phantom-deps): Angular framework package; loaded by convention. | ai | |
| phantom-deps | phantom-dep:@angular/cli | AI (phantom-deps): Angular build tool; loaded by convention. | ai | |
| phantom-deps | phantom-dep:@angular/forms | AI (phantom-deps): Angular framework package; loaded by convention. | ai | |
| phantom-deps | phantom-dep:@angular/compiler | AI (phantom-deps): Angular framework package; loaded by convention. | ai | |
| phantom-deps | phantom-dep:@angular/elements | AI (phantom-deps): Angular framework package; loaded by convention. | ai | |
| phantom-deps | phantom-dep:@angular/platform-browser | AI (phantom-deps): Angular framework package; loaded by convention. | ai | |
| phantom-deps | phantom-dep:@angular/platform-browser-dynamic | AI (phantom-deps): Angular framework package; loaded by convention. | ai | |
| phantom-deps | phantom-dep:tslib | AI (phantom-deps): Known implicit dependency for TypeScript libraries; stable pattern. | ai | |
| phantom-deps | phantom-dep:@types/three | AI (phantom-deps): Framework-scoped types loaded by convention in Three.js projects. | ai | |
| phantom-deps | phantom-dep:three-bvh-csg | AI (phantom-deps): Config-referenced dependency; stable for this package. | ai |
Versions (showing 27 of 27)
| Version | Deps | Published |
|---|---|---|
| 300.1.0 | 7 / 0 | |
| 262.1.13 | 7 / 0 | |
| 262.1.12 | 6 / 0 | |
| 262.1.11 | 6 / 0 | |
| 262.1.10 | 6 / 0 | |
| 262.1.9 | 7 / 0 | |
| 262.1.8 | 12 / 0 | |
| 262.1.7 | 12 / 0 | |
| 262.1.6 | 12 / 0 | |
| 262.1.5 | 12 / 0 | |
| 262.1.4 | 11 / 0 | |
| 262.1.3 | 11 / 0 | |
| 262.1.2 | 11 / 0 | |
| 262.1.1 | 11 / 0 | |
| 261.20.12 | 7 / 0 | |
| 261.20.11 | 7 / 0 | |
| 261.20.10 | 12 / 0 | |
| 261.20.9 | 12 / 0 | |
| 261.20.8 | 12 / 0 | |
| 261.20.7 | 12 / 0 | |
| 261.20.6 | 11 / 0 | |
| 261.20.5 | 11 / 0 | |
| 261.20.4 | 11 / 0 | |
| 261.20.1 | 4 / 0 | |
| 261.20.0 | 1 / 0 | |
| 261.1.0 | 21 / 0 | |
| 260.1.2 | 21 / 0 |
v300.1.0
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (ralf.eversen) than the most recent previously approved version (jilliscit) on 2026-07-13, but ralf.eversen is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v262.1.13
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v262.1.12
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v262.1.11
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v262.1.10
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v261.20.12
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (jilliscit) than the most recent previously approved version (patrickvkeulen) on 2026-06-30, but jilliscit is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.