@dcl/sdk
Main SDK package for building Decentraland scenes.
29
Versions
Apache-2.0
License
No
Install Scripts
Verified
Provenance
Supply chain provenance
Status for the latest visible version.
SLSA provenance attestation
npm registry signatures
gitHead linked
Maintainers
decentralandbotimazzara
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| maintainer-change | maintainer-added | AI (maintainer-change): No behavioral changes accompany the maintainer addition; provenance unchanged and attested. | ai | |
| provenance | publisher-changed | AI (provenance): Decentraland migrated publishing to GitHub Actions CI with SLSA attestation; stable pattern for this package going forward. | ai | |
| publish-pattern | rapid-publish | AI (publish-pattern): Automated CI/CD pipeline for a high-frequency package (1198 versions); rapid publishes are expected. | ai | |
| dependencies | unvetted-dep:@dcl/explorer | AI (dependencies): @dcl/explorer is a same-org Decentraland package; pinned to a specific commit-tagged version, consistent with this SDK's release pattern. | ai | |
| phantom-deps | phantom-dep:@dcl/explorer | AI (phantom-deps): Meta-package pattern; @dcl/explorer is a peer/bundled dep not directly imported in source. | ai | |
| phantom-deps | phantom-dep:@dcl/sdk-commands | AI (phantom-deps): Meta-package pattern; @dcl/sdk-commands is a CLI tool dep, not directly imported in library code. | ai | |
| phantom-deps | phantom-dep:@dcl/js-runtime | AI (phantom-deps): Meta-package pattern; @dcl/js-runtime re-exported rather than directly imported. | ai |
Versions (showing 29 of 29)
| Version | Deps | Published |
|---|---|---|
| 7.24.4 | 7 / 0 | |
| 7.24.2 | 7 / 0 | |
| 7.23.3 | 7 / 0 | |
| 7.23.1 | 7 / 0 | |
| 7.22.5 | 7 / 0 | |
| 7.22.4 | 7 / 0 | |
| 7.22.3 | 7 / 0 | |
| 7.22.1 | 7 / 0 | |
| 7.20.2 | 7 / 0 | |
| 7.17.0 | 7 / 0 | |
| 7.15.0 | 7 / 0 | |
| 7.14.0 | 7 / 0 | |
| 7.11.2 | 7 / 0 | |
| 7.11.0 | 7 / 0 | |
| 7.10.6 | 7 / 0 | |
| 7.10.5 | 7 / 0 | |
| 7.10.2 | 7 / 0 | |
| 7.10.0 | 7 / 0 | |
| 7.9.5 | 7 / 0 | |
| 7.9.2 | 7 / 0 | |
| 7.9.1 | 7 / 0 | |
| 7.9.0 | 7 / 0 | |
| 7.8.21 | 7 / 0 | |
| 7.8.18 | 7 / 0 | |
| 7.8.16 | 7 / 0 | |
| 7.8.13 | 7 / 0 | |
| 7.8.11 | 7 / 0 | |
| 7.8.7 | 7 / 0 | |
| 7.8.6 | 7 / 0 |
v7.24.4
1 finding
INFO
Has SLSA provenance attestation
provenance
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v7.14.0
1 finding
INFO
Has SLSA provenance attestation
provenance
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v7.8.11
1 finding
INFO
Has SLSA provenance attestation
provenance
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.