@cubejs-backend/shared Apache-2.0 2 versions

@cubejs-backend/shared

npm Repository Homepage

Shared code for Cube.js backend packages

Versions

Apache-2.0

License

Install Scripts

Verified

Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures gitHead linked

cubedevincstatsbotkeydunovmaxim_cube

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
bogus-package	bogus-package	AI (bogus-package): Internal monorepo package; sparse README and no keywords are expected for shared backend utilities.	ai	2026/05/05
dependencies	unvetted-dep:moment-range	AI (dependencies): moment-range is a legitimate date-range extension; stable dependency in this package across many versions.	ai	2026/05/05

Version	Deps	Published
1.3.12	15 / 11	2025-05-08
1.3.11	15 / 11	2025-05-05

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.