@decaf-ts/decorator-validation
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| publish-pattern | new-deps-added | AI (publish-pattern): Adds own-org @decaf-ts/reflection and standard reflect-metadata; legitimate. | ai | |
| source-diff | obfuscated-file:lib/model/validation.cjs | AI (source-diff): Minified gulp build output, not obfuscation; readable source confirmed in sample. | ai | |
| source-diff | obfuscated-file:lib/esm/model/validation.js | AI (source-diff): Minified/transpiled build output, not obfuscation; readable source confirmed. | ai | |
| source-diff | obfuscated-file:lib/validation/Validators/GreaterThanOrEqualValidator.cjs | AI (source-diff): TypeScript-compiled CJS output; long lines from inlined __decorate helpers, not obfuscation. | ai | |
| source-diff | obfuscated-file:lib/validation/Validators/GreaterThanValidator.cjs | AI (source-diff): TypeScript-compiled CJS output; long lines from inlined __decorate helpers, not obfuscation. | ai | |
| source-diff | obfuscated-file:lib/validation/Validators/LessThanOrEqualValidator.cjs | AI (source-diff): TypeScript-compiled CJS output; long lines from inlined __decorate helpers, not obfuscation. | ai | |
| source-diff | obfuscated-file:lib/validation/Validators/LessThanValidator.cjs | AI (source-diff): TypeScript-compiled CJS output; long lines from inlined __decorate helpers, not obfuscation. | ai | |
| source-diff | obfuscated-file:lib/validation/Validators/utils.cjs | AI (source-diff): TypeScript-compiled CJS output; readable utility functions, not obfuscation. | ai | |
| source-diff | obfuscated-file:lib/esm/validation/Validators/DiffValidator.js | AI (source-diff): TypeScript-compiled ESM output; long lines from inlined __decorate helpers, not obfuscation. | ai | |
| source-diff | obfuscated-file:lib/esm/validation/Validators/GreaterThanOrEqualValidator.js | AI (source-diff): TypeScript-compiled ESM output; long lines from inlined __decorate helpers, not obfuscation. | ai | |
| source-diff | obfuscated-file:lib/esm/validation/Validators/GreaterThanValidator.js | AI (source-diff): TypeScript-compiled ESM output; long lines from inlined __decorate helpers, not obfuscation. | ai | |
| source-diff | obfuscated-file:lib/esm/validation/Validators/LessThanOrEqualValidator.js | AI (source-diff): TypeScript-compiled ESM output; long lines from inlined __decorate helpers, not obfuscation. | ai | |
| source-diff | obfuscated-file:lib/esm/validation/Validators/LessThanValidator.js | AI (source-diff): TypeScript-compiled ESM output; long lines from inlined __decorate helpers, not obfuscation. | ai | |
| source-diff | obfuscated-file:lib/esm/validation/Validators/utils.js | AI (source-diff): TypeScript-compiled ESM output; readable utility functions, not obfuscation. | ai | |
| source-diff | obfuscated-file:lib/esm/validation/Validators/EqualsValidator.js | AI (source-diff): TypeScript-compiled ESM output; long lines from inlined __decorate helpers, not obfuscation. | ai | |
| source-diff | obfuscated-file:lib/validation/Validators/DiffValidator.cjs | AI (source-diff): TypeScript-compiled CJS output; long lines from inlined __decorate helpers, not obfuscation. | ai | |
| source-diff | obfuscated-file:lib/validation/Validators/EqualsValidator.cjs | AI (source-diff): TypeScript-compiled CJS output; long lines from inlined __decorate helpers, not obfuscation. | ai | |
| provenance | no-provenance | AI (provenance): Long-established package; no provenance has been consistent across versions. | ai |
Versions (showing 37 of 37)
| Version | Deps | Published |
|---|---|---|
| 1.11.24 | 1 / 2 | |
| 1.11.23 | 1 / 2 | |
| 1.11.10 | 1 / 1 | |
| 1.11.9 | 1 / 1 | |
| 1.11.8 | 1 / 1 | |
| 1.11.7 | 1 / 1 | |
| 1.11.6 | 1 / 1 | |
| 1.11.5 | 1 / 1 | |
| 1.11.4 | 1 / 1 | |
| 1.11.3 | 1 / 1 | |
| 1.11.2 | 1 / 1 | |
| 1.11.1 | 1 / 1 | |
| 1.11.0 | 1 / 1 | |
| 1.10.5 | 2 / 1 | |
| 1.10.4 | 2 / 1 | |
| 1.10.3 | 0 / 6 | |
| 1.7.3 | 0 / 32 | |
| 1.7.2 | 0 / 32 | |
| 1.7.1 | 0 / 32 | |
| 1.7.0 | 0 / 32 | |
| 1.6.5 | 0 / 31 | |
| 1.6.4 | 0 / 31 | |
| 1.6.3 | 0 / 31 | |
| 1.6.2 | 0 / 31 | |
| 1.4.2 | 2 / 33 | |
| 1.3.7 | 0 / 33 | |
| 1.0.22 | 0 / 32 | |
| 1.0.21 | 1 / 32 | |
| 1.0.18 | 1 / 32 | |
| 1.0.17 | 1 / 32 | |
| 1.0.16 | 1 / 32 | |
| 1.0.15 | 1 / 32 | |
| 1.0.14 | 1 / 32 | |
| 1.0.13 | 1 / 32 | |
| 1.0.12 | 1 / 32 | |
| 1.0.11 | 1 / 32 | |
| 1.0.7 | 2 / 31 |
v1.4.2
4 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: tvenceslau.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.3.7
4 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: tvenceslau.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.22
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.21
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.18
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.17
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.16
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.15
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.14
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.13
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.12
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.11
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.7
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.