@dathomir/core
dathomir package
Supply chain provenance
Status for the latest visible version.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| dependencies | unvetted-dep:@dathomir/store | AI (dependencies): @dathomir/store is a first-party sibling package in the same dathomir-js monorepo; flagging it as unvetted is a stable false positive for this package family. | ai | |
| publish-pattern | new-deps-added | AI (publish-pattern): The new dep is @dathomir/store, a same-namespace monorepo sibling. Adding internal sibling deps is expected as the framework grows; not an injection risk. | ai | |
| typosquat | typosquat.levenshtein:cors | AI (typosquat): @dathomir/core is the core package of the dathomir framework monorepo; the levenshtein match to 'cors' is coincidental and not an impersonation attempt. | ai |
Versions (showing 8 of 8)
| Version | Deps | Published |
|---|---|---|
| 0.0.12 | 5 / 6 | |
| 0.0.11 | 5 / 6 | |
| 0.0.10 | 4 / 6 | |
| 0.0.9 | 4 / 6 | |
| 0.0.8 | 4 / 6 | |
| 0.0.7 | 4 / 6 | |
| 0.0.5 | 4 / 6 | |
| 0.0.4 | 4 / 6 |
v0.0.12
2 findingsPackage name '@dathomir/core' is 1 edit(s) away from popular package 'cors'.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.0.11
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.0.10
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.0.9
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.0.8
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.0.7
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.0.5
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.0.4
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.