@elastic/apm-rum-core
Supply chain provenance
Status for the latest visible version.
Maintainers
Versions (showing 8 of 8)
| Version | Deps | Published |
|---|---|---|
| 5.25.3 | 3 / 0 | |
| 5.25.2 | 3 / 0 | |
| 5.25.1 | 3 / 0 | |
| 5.25.0 | 3 / 0 | |
| 5.23.0 | 3 / 0 | |
| 5.22.1 | 3 / 0 | |
| 5.22.0 | 3 / 0 | |
| 5.21.1 | 3 / 0 |
v5.25.3
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v5.23.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.22.1
2 findingsThis version was published by a different npm account (obltmachine) than the most recent previously approved version (elasticmachine) on 2025-01-10. It has since remained available on npm for 554 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.22.0
2 findingsThis version was published by a different npm account (obltmachine) than the most recent previously approved version (elasticmachine) on 2025-01-09. It has since remained available on npm for 555 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.21.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.