@e-llm-studio/streaming-response
stream messages from eLLM
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| phantom-deps | phantom-dep:utf8 | AI (phantom-deps): Declared in dependencies; used in bundled output, not directly imported. | ai | |
| phantom-deps | phantom-dep:uuid | AI (phantom-deps): Declared in dependencies; used in bundled output, not directly imported. | ai | |
| phantom-deps | phantom-dep:axios | AI (phantom-deps): Declared in dependencies; used in bundled output, not directly imported. | ai | |
| phantom-deps | phantom-dep:graphql-ws | AI (phantom-deps): Declared in dependencies; used in bundled output, not directly imported. | ai | |
| provenance | publisher-changed | AI (provenance): Publisher has strong track record (78 approved/0 rejected); recurring org-internal transition. | ai | |
| maintainer-change | maintainer-added | AI (maintainer-change): Same trusted publisher account added as maintainer, no behavioral change. | ai |
Versions (showing 95 of 95)
| Version | Deps | Published |
|---|---|---|
| 1.1.87 | 6 / 7 | |
| 1.1.86 | 6 / 7 | |
| 1.1.85 | 6 / 7 | |
| 1.1.84 | 6 / 7 | |
| 1.1.83 | 6 / 7 | |
| 1.1.82 | 6 / 7 | |
| 1.1.81 | 6 / 7 | |
| 1.1.80 | 6 / 7 | |
| 1.1.79 | 6 / 7 | |
| 1.1.78 | 6 / 7 | |
| 1.1.77 | 6 / 7 | |
| 1.1.76 | 6 / 7 | |
| 1.1.75 | 6 / 7 | |
| 1.1.74 | 6 / 7 | |
| 1.1.73 | 6 / 7 | |
| 1.1.72 | 6 / 7 | |
| 1.1.71 | 6 / 7 | |
| 1.1.70 | 6 / 7 | |
| 1.1.69 | 6 / 7 | |
| 1.1.68 | 6 / 7 | |
| 1.1.67 | 6 / 7 | |
| 1.1.66 | 6 / 7 | |
| 1.1.65 | 6 / 7 | |
| 1.1.64 | 6 / 7 | |
| 1.1.63 | 6 / 7 | |
| 1.1.62 | 6 / 7 | |
| 1.1.61 | 6 / 7 | |
| 1.1.60 | 6 / 7 | |
| 1.1.59 | 6 / 7 | |
| 1.1.58 | 6 / 7 | |
| 1.1.57 | 6 / 7 | |
| 1.1.56 | 6 / 7 | |
| 1.1.55 | 6 / 7 | |
| 1.1.54 | 6 / 7 | |
| 1.1.53 | 6 / 7 | |
| 1.1.52 | 6 / 7 | |
| 1.1.51 | 6 / 7 | |
| 1.1.50 | 6 / 7 | |
| 1.1.49 | 6 / 7 | |
| 1.1.48 | 6 / 7 | |
| 1.1.47 | 6 / 7 | |
| 1.1.46 | 6 / 7 | |
| 1.1.45 | 6 / 7 | |
| 1.1.44 | 6 / 7 | |
| 1.1.43 | 6 / 7 | |
| 1.1.41 | 6 / 7 | |
| 1.1.40 | 6 / 7 | |
| 1.1.39 | 6 / 7 | |
| 1.1.38 | 6 / 7 | |
| 1.1.37 | 6 / 7 | |
| 1.1.36 | 6 / 7 | |
| 1.1.35 | 6 / 7 | |
| 1.1.34 | 6 / 7 | |
| 1.1.33 | 6 / 7 | |
| 1.1.32 | 6 / 7 | |
| 1.1.31 | 6 / 7 | |
| 1.1.30 | 6 / 7 | |
| 1.1.29 | 6 / 7 | |
| 1.1.28 | 6 / 7 | |
| 1.1.27 | 6 / 7 | |
| 1.1.26 | 6 / 7 | |
| 1.1.25 | 6 / 7 | |
| 1.1.24 | 6 / 7 | |
| 1.1.23 | 6 / 7 | |
| 1.1.22 | 6 / 7 | |
| 1.1.21 | 6 / 7 | |
| 1.1.20 | 6 / 7 | |
| 1.1.19 | 6 / 7 | |
| 1.1.18 | 6 / 7 | |
| 1.1.17 | 6 / 7 | |
| 1.1.16 | 4 / 5 | |
| 1.1.15 | 6 / 7 | |
| 1.1.14 | 4 / 5 | |
| 1.1.13 | 4 / 5 | |
| 1.1.12 | 4 / 5 | |
| 1.1.11 | 4 / 5 | |
| 1.1.10 | 4 / 5 | |
| 1.1.9 | 4 / 5 | |
| 1.1.8 | 4 / 5 | |
| 1.1.6 | 4 / 5 | |
| 1.1.5 | 4 / 5 | |
| 1.1.4 | 4 / 5 | |
| 1.1.3 | 5 / 4 | |
| 1.1.2 | 5 / 4 | |
| 1.1.1 | 5 / 4 | |
| 1.0.10 | 5 / 4 | |
| 1.0.9 | 5 / 4 | |
| 1.0.8 | 5 / 4 | |
| 1.0.7 | 5 / 4 | |
| 1.0.6 | 5 / 8 | |
| 1.0.5 | 5 / 4 | |
| 1.0.4 | 5 / 4 | |
| 1.0.3 | 5 / 4 | |
| 1.0.2 | 4 / 4 | |
| 1.0.0 | 4 / 4 |
v1.1.87
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.1.86
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.1.85
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.1.84
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.1.83
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.1.82
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.1.81
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.1.80
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (shivendra12131) than the most recent previously approved version (mkathyayani) on 2026-06-29, but shivendra12131 is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v1.1.55
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.1.54
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2025-10-24. This could indicate a legitimate maintainer transition or an account compromise.
v1.1.53
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (shivendra12131) than the most recent previously approved version (deveshpatel) on 2025-10-10, but shivendra12131 is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v1.1.52
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (shivendra12131) than the most recent previously approved version (deveshpatel) on 2025-09-26, but shivendra12131 is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v1.1.50
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (shivendra12131) than the most recent previously approved version (saurabhgathade) on 2025-09-03, but shivendra12131 is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v1.1.49
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.1.48
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (shivendra12131) than the most recent previously approved version (saurabhgathade) on 2025-09-03, but shivendra12131 is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v1.1.47
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.1.46
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.1.45
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.1.44
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.1.43
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.1.41
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.1.40
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (saurabhgathade) than the most recent previously approved version (shivendra12131) on 2025-07-09, but saurabhgathade is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v1.1.39
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (shivendra12131) than the most recent previously approved version (saurabhgathade) on 2025-07-03, but shivendra12131 is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v1.1.38
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (saurabhgathade) than the most recent previously approved version (deveshpatel) on 2025-07-03, but saurabhgathade is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v1.1.37
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (saurabhgathade) than the most recent previously approved version (deveshpatel) on 2025-07-02, but saurabhgathade is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v1.1.35
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (saurabhgathade) than the most recent previously approved version (shivendra12131) on 2025-06-03, but saurabhgathade is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v1.1.34
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (shivendra12131) than the most recent previously approved version (deveshpatel) on 2025-05-29, but shivendra12131 is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v1.1.33
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (shivendra12131) than the most recent previously approved version (saurabhgathade) on 2025-05-29, but shivendra12131 is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v1.1.32
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (saurabhgathade) than the most recent previously approved version (deveshpatel) on 2025-05-13, but saurabhgathade is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v1.1.27
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (saurabhgathade) than the most recent previously approved version (deveshpatel) on 2025-04-21, but saurabhgathade is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v1.1.26
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.1.25
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.1.24
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.1.23
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.1.22
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (deveshpatel) than the most recent previously approved version (saurabhgathade) on 2025-04-17, but deveshpatel is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v1.1.21
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.1.20
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (saurabhgathade) than the most recent previously approved version (shivendra12131) on 2025-04-04, but saurabhgathade is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v1.1.19
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.1.18
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.1.17
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (shivendra12131) than the most recent previously approved version (saurabhgathade) on 2025-03-19, but shivendra12131 is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v1.1.16
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (saurabhgathade) than the most recent previously approved version (shivendra12131) on 2025-03-18, but saurabhgathade is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v1.1.15
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (shivendra12131) than the most recent previously approved version (saurabhgathade) on 2025-03-17, but shivendra12131 is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v1.1.14
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.1.13
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.1.12
2 findingsThis version was published by a different npm account than previous versions on 2025-02-12. This could indicate a legitimate maintainer transition or an account compromise.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.1.11
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.1.10
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.1.9
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.1.8
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.1.6
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.1.5
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.1.4
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.1.3
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.1.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.1.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.10
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.9
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.8
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.7
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.6
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.5
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.4
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.3
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.