← Home

@digdir/designsystemet-css

npm Repository Homepage
48
Versions
—
License
No
Install Scripts
Verified
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures No source commit

Maintainers

candaltoyvindthunejensmoksvedalaltinnadminbarsnesmimarz

Keywords

cssdesignsystemdesignsystemetdigdir

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
provenance publisher-changed AI (provenance): Transition to GitHub Actions CI publisher is confirmed by SLSA attestation; legitimate for this org. ai
maintainer-change maintainer-added AI (maintainer-change): altinnadmin is consistent with digdir org admin account; addition accompanies CI migration. ai
provenance missing-githead AI (provenance): CSS-only package with clean history; missing gitHead is a publish-env change, not a malware indicator. ai
dependencies unvetted-dep:@digdir/designsystemet-types AI (dependencies): Same-org monorepo sibling package; consistently co-versioned with this package across all releases. ai

Versions (showing 48 of 48)

Version Deps Published
1.18.0 1 / 8
1.17.0 1 / 8
1.16.1 1 / 8
1.16.0 1 / 8
1.15.0 1 / 8
1.14.0 1 / 8
1.13.3 1 / 8
1.13.2 1 / 8
1.13.1 1 / 8
1.13.0 1 / 8
1.12.1 1 / 8
1.12.0 1 / 8
1.11.1 1 / 8
1.11.0 1 / 8
1.10.0 1 / 8
1.9.0 0 / 8
1.8.0 0 / 7
1.7.3 0 / 7
1.7.2 0 / 7
1.7.1 0 / 7
1.7.0 0 / 7
1.6.1 0 / 7
1.6.0 0 / 7
1.5.1 0 / 7
1.5.0 0 / 7
1.4.0 0 / 7
1.3.0 0 / 7
1.2.0 0 / 7
1.1.10 0 / 7
1.1.9 0 / 7
1.1.8 0 / 7
1.1.7 0 / 7
1.1.6 0 / 7
1.1.5 0 / 7
1.1.4 0 / 7
1.1.3 0 / 7
1.1.2 0 / 7
1.1.1 0 / 7
1.1.0 0 / 7
1.0.8 0 / 7
1.0.7 0 / 7
1.0.6 0 / 7
1.0.5 0 / 7
1.0.4 0 / 7
1.0.3 0 / 7
1.0.2 0 / 7
1.0.1 0 / 7
1.0.0 0 / 7

v1.18.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.0.4

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.0.3

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.0.2

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.0.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.0.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.