← Home

@dicebear/toon-head

npm Repository Homepage

Avatar style for DiceBear

7
Versions
(MIT AND CC-BY-4.0)
License
No
Install Scripts
Verified
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures gitHead linked

Maintainers

floriankoerner

Keywords

dicebear

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
bogus-package bogus-package AI (bogus-package): Intentional namespace-reservation stub under the official @dicebear monorepo; empty payload is expected. ai
npm-metadata suspicious-initial-version AI (npm-metadata): Version 0.0.0 is consistent with a monorepo placeholder; not indicative of malicious intent here. ai

Versions (showing 7 of 7)

Version Deps Published
9.4.2 0 / 4
9.4.1 0 / 4
9.4.0 0 / 4
9.3.2 0 / 4
9.3.1 0 / 5
9.3.0 0 / 5
0.0.0 0 / 0

v9.4.1

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v9.4.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v9.3.2

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v9.3.1

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v9.3.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.0.0

2 findings
HIGH Low-value / spam package indicators (6 signals, score 7) bogus-package

Matched 6 signal(s), weighted score 7: • [S_README_NO_CODE] Short README with no code block, no install instructions, and no usage/API section. • [S_DESC_MATCHES_NAME] Description is empty or just restates the package name. • [S_NO_KEYWORDS] No keywords declared. • [S_NO_DEPS] No runtime, dev, peer, or optional dependencies declared. • [S_TINY_PAYLOAD] Tiny payload: 1 code file(s), 483 bytes total. • [S_EMPTY_MAIN] Entry point (index.js) is 0 bytes — effectively empty.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.