← Home

@entur-partner/common

npm Repository Homepage
19
Versions
—
License
No
Install Scripts
Missing
Provenance

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.

Maintainers

artur.krauzekennethngotutturen

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
provenance publisher-changed AI (provenance): tutturen is an established publisher (22 approved) within the entur org; transition appears legitimate. ai
license copyleft-license:EUPL-1.2 AI (license): EUPL-1.2 is the declared license; stable across all versions of this package. ai
npm-metadata no-description AI (npm-metadata): Established package with clear purpose; missing description is benign for internal/partner libraries. ai
dependencies unvetted-dep:@entur-partner/util AI (dependencies): Same-org internal dependency; stable pattern across all versions of this package. ai
provenance no-provenance AI (provenance): Published via GitHub Actions from the official entur org; provenance absence is a process gap, not a security risk for this package. ai
phantom-deps phantom-dep:classnames AI (phantom-deps): classnames is a declared runtime dependency in package.json; phantom-dep is a false positive for this package. ai

Versions (showing 19 of 19)

Version Deps Published
11.4.0 2 / 9
11.3.2 2 / 9
11.3.1 2 / 9
11.3.0 2 / 9
11.2.8 2 / 9
11.2.7 2 / 9
11.2.6 2 / 9
11.2.5 2 / 9
11.2.4 2 / 4
11.2.3 2 / 4
11.2.0 2 / 4
11.1.3 2 / 4
11.1.2 2 / 4
11.1.1 2 / 4
11.1.0 2 / 4
11.0.1 2 / 4
11.0.0 2 / 4
10.0.3 2 / 4
10.0.2 2 / 4

v11.4.0

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.