@compilot/js-sdk
ComPilot JS SDK
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| provenance | no-provenance | AI (provenance): Consistent across all 360 versions; no provenance is the norm for this publisher. | ai | |
| typosquat | typosquat.levenshtein:aws-sdk | AI (typosquat): @compilot/js-sdk is a scoped ComPilot platform SDK, not a typosquat of aws-sdk; Levenshtein match is coincidental. | ai | |
| phantom-deps | phantom-dep:pino | AI (phantom-deps): pino is a declared runtime dep used as a logger; phantom-dep heuristic fires because it may be re-exported via @nexeraid/logger. | ai |
Versions (showing 22 of 22)
| Version | Deps | Published |
|---|---|---|
| 2.227.0 | 7 / 4 | |
| 2.224.0 | 7 / 4 | |
| 2.222.0 | 7 / 4 | |
| 2.221.0 | 7 / 4 | |
| 2.220.0 | 7 / 4 | |
| 2.219.0 | 7 / 4 | |
| 2.214.0 | 7 / 4 | |
| 2.213.0 | 7 / 4 | |
| 2.212.0 | 7 / 4 | |
| 2.209.0 | 7 / 4 | |
| 2.202.0 | 7 / 4 | |
| 2.199.0 | 7 / 4 | |
| 2.191.0 | 7 / 4 | |
| 2.171.0 | 7 / 4 | |
| 2.167.0 | 7 / 4 | |
| 2.165.0 | 7 / 4 | |
| 2.157.0 | 7 / 4 | |
| 2.151.0 | 7 / 4 | |
| 2.140.0 | 7 / 4 | |
| 2.133.0 | 7 / 4 | |
| 2.132.0 | 7 / 4 | |
| 2.128.0 | 7 / 4 |
v2.227.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.224.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.222.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v2.221.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.220.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v2.219.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v2.214.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v2.213.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.212.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v2.209.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.202.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.199.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.191.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.171.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.167.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v2.165.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.157.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.151.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.140.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v2.133.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.132.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.128.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.