@evergis/api
Библиотека API.
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| typosquat | typosquat.levenshtein:hapi | AI (typosquat): Scoped @evergis package; Levenshtein match on '/api' suffix is a false positive, not a typosquat. | ai | |
| typosquat | typosquat.levenshtein:pg | AI (typosquat): Same false positive pattern — scoped package name coincidentally close to short unrelated package names. | ai | |
| typosquat | typosquat.levenshtein:joi | AI (typosquat): Same false positive pattern — scoped package name coincidentally close to short unrelated package names. | ai | |
| typosquat | typosquat.levenshtein:ajv | AI (typosquat): Same false positive pattern — scoped package name coincidentally close to short unrelated package names. | ai | |
| phantom-deps | phantom-dep:lodash | AI (phantom-deps): lodash is in dependencies; phantom-dep heuristic misfires when usage is indirect or in config files. | ai | |
| phantom-deps | phantom-dep:swagger-typescript-api | AI (phantom-deps): swagger-typescript-api is a codegen tool invoked via generate script; not directly imported in source. | ai |
Versions (showing 38 of 38)
| Version | Deps | Published |
|---|---|---|
| 5.0.37 | 6 / 0 | |
| 5.0.36 | 6 / 0 | |
| 5.0.35 | 6 / 0 | |
| 5.0.34 | 6 / 0 | |
| 5.0.33 | 6 / 0 | |
| 5.0.30 | 6 / 0 | |
| 5.0.28 | 6 / 0 | |
| 5.0.27 | 6 / 0 | |
| 5.0.26 | 6 / 0 | |
| 5.0.25 | 6 / 0 | |
| 5.0.23 | 6 / 0 | |
| 5.0.22 | 6 / 0 | |
| 5.0.20 | 6 / 0 | |
| 5.0.19 | 6 / 0 | |
| 5.0.17 | 6 / 0 | |
| 5.0.15 | 6 / 0 | |
| 5.0.13 | 6 / 0 | |
| 5.0.12 | 6 / 0 | |
| 5.0.10 | 6 / 0 | |
| 5.0.9 | 6 / 0 | |
| 5.0.8 | 6 / 0 | |
| 5.0.5 | 6 / 0 | |
| 5.0.2 | 6 / 0 | |
| 4.1.54 | 6 / 0 | |
| 4.1.50 | 6 / 0 | |
| 4.1.49 | 6 / 0 | |
| 4.1.47 | 6 / 0 | |
| 4.1.41 | 6 / 0 | |
| 4.1.38 | 6 / 0 | |
| 4.1.35 | 6 / 0 | |
| 4.1.26 | 6 / 0 | |
| 4.1.24 | 6 / 0 | |
| 4.1.23 | 6 / 0 | |
| 4.1.22 | 6 / 0 | |
| 4.1.21 | 6 / 0 | |
| 4.1.20 | 6 / 0 | |
| 4.1.19 | 6 / 0 | |
| 4.1.18 | 6 / 0 |
v5.0.37
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (arfeo) than the most recent previously approved version (alexanderbom) on 2026-07-23, but arfeo is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v5.0.36
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (alexanderbom) than the most recent previously approved version (arfeo) on 2026-07-16, but alexanderbom is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v5.0.35
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (arfeo) than the most recent previously approved version (alexanderbom) on 2026-07-16, but arfeo is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v5.0.34
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.0.33
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (alexanderbom) than the most recent previously approved version (arfeo) on 2026-07-01, but alexanderbom is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.