← Home

@embroider/addon-shim

npm Repository Homepage
24
Versions
—
License
No
Install Scripts
Verified
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures No source commit

Maintainers

nullvoxpopulisimonihmigef4rwjbluekatiegenglerreal_ate

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
provenance publisher-changed AI (provenance): Moved to GitHub Actions CI/CD publishing with SLSA provenance; legitimate transition for this org. ai
publish-pattern dormant-publish AI (publish-pattern): Mature package with infrequent releases; dormancy is normal for stable Embroider infra. ai
semgrep semgrep:dynamic-require AI (semgrep): Intentional plugin-loader resolving a fixed sibling package path; stable pattern for this package. ai
dependencies unvetted-dep:broccoli-funnel AI (dependencies): broccoli-funnel is a well-known Ember/Broccoli build tool; stable false positive for this package. ai
dependencies unvetted-dep:@embroider/shared-internals AI (dependencies): Same-org sibling package; expected dependency for embroider tooling. ai

Versions (showing 24 of 24)

Version Deps Published
1.10.3 4 / 5
1.10.2 4 / 5
1.10.1 4 / 5
1.10.0 4 / 5
1.9.0 4 / 5
1.8.9 4 / 5
1.8.8 4 / 5
1.8.7 3 / 4
1.8.6 3 / 4
1.8.5 3 / 4
1.8.4 3 / 4
1.8.3 2 / 3
1.8.2 2 / 3
1.8.1 2 / 3
1.8.0 2 / 3
1.7.1 2 / 3
1.7.0 2 / 3
1.6.0 2 / 3
1.5.0 2 / 3
1.4.0 2 / 3
1.3.0 2 / 3
1.2.0 2 / 3
1.1.0 2 / 3
1.0.0 2 / 3

v1.10.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.9.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.8.9

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.8.8

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.8.7

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.8.6

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.8.5

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.8.4

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.8.3

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.8.2

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.8.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.8.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.7.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.7.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.6.0

2 findings
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: ef4 → rwjblue (on 2022-04-07, known maintainer) provenance

This version was published by a different npm account (rwjblue) than the most recent previously approved version (ef4) on 2022-04-07, but rwjblue is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

v1.5.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.4.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.3.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.2.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.1.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.0.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.