@eqproject/eqp-table
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| dependencies | unvetted-dep:mat-table-exporter | AI (dependencies): mat-table-exporter is a legitimate Angular Material table export library; consistent with this package's documented functionality. | ai | |
| phantom-deps | phantom-dep:@fortawesome/fontawesome-free | AI (phantom-deps): FontAwesome CSS-only package; referenced in config/styles rather than direct JS imports — stable false positive for this package. | ai | |
| publish-pattern | dormant-publish | AI (publish-pattern): Package has 153 versions over 2137 days; dormancy likely reflects Angular major-version cadence, not takeover. | ai | |
| npm-metadata | url-dep:xlsx | AI (npm-metadata): SheetJS distributes via cdn.sheetjs.com as their official channel; stable pattern for this package. | ai | |
| dependencies | unvetted-dep:xlsx | AI (dependencies): xlsx is a standard spreadsheet library used for table export; expected dependency for this package type. | ai | |
| provenance | no-provenance | AI (provenance): Established org package; lack of provenance is consistent across all 151 versions and is low risk here. | ai | |
| phantom-deps | phantom-dep:tslib | AI (phantom-deps): tslib is a standard Angular/TypeScript implicit runtime dep; stable false positive for Angular libraries. | ai | |
| phantom-deps | phantom-dep:@fortawesome/free-solid-svg-icons | AI (phantom-deps): Referenced in Angular config/module files; standard Angular library pattern, not a direct import. | ai | |
| phantom-deps | phantom-dep:@fortawesome/fontawesome-svg-core | AI (phantom-deps): Referenced in Angular config/module files; standard Angular library pattern, not a direct import. | ai | |
| phantom-deps | phantom-dep:@fortawesome/angular-fontawesome | AI (phantom-deps): Referenced in Angular config/module files; standard Angular library pattern, not a direct import. | ai |
Versions (showing 8 of 8)
| Version | Deps | Published |
|---|---|---|
| 21.0.1 | 5 / 0 | |
| 21.0.0 | 5 / 0 | |
| 3.0.27 | 5 / 0 | |
| 3.0.26 | 5 / 0 | |
| 3.0.25 | 5 / 0 | |
| 3.0.24 | 5 / 0 | |
| 3.0.23 | 5 / 0 | |
| 2.6.0 | 10 / 0 |
v21.0.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v21.0.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v3.0.27
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v3.0.26
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v3.0.25
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v3.0.24
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v3.0.23
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v2.6.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.