@duckcodeailabs/dql-connectors
DQL database connectors for local files, SQL warehouses, and lakehouse engines
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| provenance | missing-githead | AI (provenance): Package has a strong publisher track record (57 approved, 0 rejected) and no other malicious signals. Missing gitHead likely reflects a publish environment change, not a supply chain compromise. | ai | |
| publish-pattern | new-deps-added | AI (publish-pattern): @aws-sdk/client-athena is the official AWS Athena SDK, consistent with this package's purpose as a multi-database connector library. Addition is benign. | ai | |
| dependencies | unvetted-dep:@aws-sdk/client-athena | AI (dependencies): Official AWS SDK for Athena; entirely consistent with the package's purpose as a cloud data warehouse connector. | ai | |
| dependencies | unvetted-dep:duckdb | AI (dependencies): duckdb is a legitimate, well-known embedded analytics database SDK; its use is expected for a database connector package. | ai | |
| phantom-deps | phantom-dep:@aws-sdk/client-athena | AI (phantom-deps): Connector framework may load Athena adapter by convention rather than direct import; declared dependency is appropriate. | ai | |
| dependencies | unvetted-dep:@google-cloud/bigquery | AI (dependencies): Official Google Cloud BigQuery client; entirely consistent with the package's purpose as a cloud data warehouse connector. | ai | |
| dependencies | unvetted-dep:snowflake-sdk | AI (dependencies): snowflake-sdk is the official Snowflake Node.js driver; its use is expected for a multi-database connector library. | ai |
Versions (showing 53 of 53)
| Version | Deps | Published |
|---|---|---|
| 1.6.0 | 8 / 6 | |
| 1.5.3 | 8 / 6 | |
| 1.5.2 | 8 / 6 | |
| 1.5.1 | 8 / 6 | |
| 1.5.0 | 8 / 6 | |
| 1.4.4 | 8 / 6 | |
| 1.4.3 | 8 / 6 | |
| 1.4.1 | 8 / 6 | |
| 1.4.0 | 8 / 6 | |
| 1.3.6 | 8 / 6 | |
| 1.3.5 | 8 / 6 | |
| 1.3.4 | 8 / 6 | |
| 1.3.2 | 8 / 6 | |
| 1.3.1 | 8 / 6 | |
| 1.3.0 | 8 / 6 | |
| 1.2.2 | 8 / 6 | |
| 1.2.0 | 8 / 6 | |
| 1.0.4 | 8 / 6 | |
| 1.0.3 | 8 / 6 | |
| 1.0.2 | 8 / 6 | |
| 1.0.1 | 8 / 6 | |
| 0.11.0 | 8 / 6 | |
| 0.10.2 | 8 / 6 | |
| 0.10.1 | 8 / 6 | |
| 0.10.0 | 8 / 6 | |
| 0.9.0 | 8 / 6 | |
| 0.8.16 | 8 / 6 | |
| 0.8.15 | 8 / 6 | |
| 0.8.14 | 8 / 6 | |
| 0.8.13 | 8 / 6 | |
| 0.8.12 | 8 / 6 | |
| 0.8.11 | 8 / 6 | |
| 0.8.10 | 8 / 6 | |
| 0.8.9 | 8 / 6 | |
| 0.8.8 | 8 / 6 | |
| 0.8.7 | 8 / 6 | |
| 0.8.6 | 8 / 6 | |
| 0.8.5 | 8 / 6 | |
| 0.8.4 | 8 / 6 | |
| 0.8.3 | 8 / 6 | |
| 0.8.2 | 8 / 6 | |
| 0.8.1 | 8 / 6 | |
| 0.8.0 | 8 / 6 | |
| 0.7.1 | 8 / 6 | |
| 0.7.0 | 8 / 6 | |
| 0.6.0 | 8 / 6 | |
| 0.1.6 | 8 / 6 | |
| 0.1.5 | 8 / 6 | |
| 0.1.4 | 8 / 6 | |
| 0.1.3 | 8 / 6 | |
| 0.1.2 | 8 / 6 | |
| 0.1.1 | 8 / 6 | |
| 0.1.0 | 7 / 6 |
v1.6.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.5.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.5.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.4.4
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.4.3
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.4.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.4.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.3.6
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.3.5
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.3.4
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.3.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.3.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.3.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.2.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.2.0
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: duckcode.
v1.0.4
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.3
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.11.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.10.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.10.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.10.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.9.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.8.16
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.8.15
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.8.14
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.8.13
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.8.12
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.8.11
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.8.10
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.8.9
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.8.8
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: duckcode.
v0.8.7
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.8.6
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.8.5
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.8.4
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: duckcode.
v0.8.3
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.8.2
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: duckcode.
v0.8.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.8.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.7.1
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: duckcode.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.7.0
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: duckcode.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.6.0
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: duckcode.
v0.1.6
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.1.5
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.1.4
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.1.3
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.1.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.1.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.1.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.