@firebase/messaging-compat
This is the compat package that recreates the v8 APIs.
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| dependencies | unvetted-dep:@firebase/util | AI (dependencies): Sibling package from the official firebase-js-sdk monorepo; not a third-party unvetted dependency. | ai | |
| provenance | no-provenance | AI (provenance): Official Firebase SDK package published by Google automation account; lack of Sigstore provenance is expected for this established package family. | ai | |
| dependencies | unvetted-dep:@firebase/messaging | AI (dependencies): Sibling package from the official firebase-js-sdk monorepo; not a third-party unvetted dependency. | ai | |
| maintainer-change | maintainer-removed | AI (maintainer-change): Maintainer removal is consistent with consolidation under google-wombot automated publishing; stable pattern across Firebase packages. | ai | |
| provenance | publisher-changed | AI (provenance): google-wombot is Google's official Firebase publishing bot; transition from named engineer to bot account is standard Google/Firebase practice, not a takeover signal. | ai | |
| bogus-package | bogus-package | AI (bogus-package): This is a Firebase SDK monorepo sub-package; short README and no keywords are expected for internal scoped packages, not spam indicators. | ai | |
| phantom-deps | phantom-dep:tslib | AI (phantom-deps): tslib is declared as a direct dependency in package.json; phantom-dep flag is a false positive for this TypeScript-compiled package. | ai |
Versions (showing 49 of 49)
| Version | Deps | Published |
|---|---|---|
| 0.2.26 | 4 / 5 | |
| 0.2.25 | 4 / 5 | |
| 0.2.24 | 4 / 5 | |
| 0.2.23 | 4 / 5 | |
| 0.2.22 | 4 / 5 | |
| 0.2.21 | 4 / 5 | |
| 0.2.20 | 4 / 5 | |
| 0.2.19 | 4 / 5 | |
| 0.2.18 | 4 / 5 | |
| 0.2.17 | 4 / 5 | |
| 0.2.16 | 4 / 5 | |
| 0.2.15 | 4 / 5 | |
| 0.2.14 | 4 / 5 | |
| 0.2.13 | 4 / 5 | |
| 0.2.12 | 4 / 5 | |
| 0.2.11 | 4 / 5 | |
| 0.2.10 | 4 / 5 | |
| 0.2.9 | 4 / 5 | |
| 0.2.8 | 4 / 5 | |
| 0.2.7 | 4 / 5 | |
| 0.2.6 | 4 / 5 | |
| 0.2.5 | 4 / 5 | |
| 0.2.4 | 4 / 5 | |
| 0.2.3 | 4 / 5 | |
| 0.2.2 | 4 / 5 | |
| 0.2.1 | 4 / 5 | |
| 0.2.0 | 4 / 5 | |
| 0.1.21 | 4 / 5 | |
| 0.1.20 | 4 / 5 | |
| 0.1.19 | 4 / 5 | |
| 0.1.18 | 4 / 5 | |
| 0.1.17 | 4 / 5 | |
| 0.1.16 | 4 / 5 | |
| 0.1.15 | 4 / 5 | |
| 0.1.14 | 4 / 5 | |
| 0.1.13 | 4 / 5 | |
| 0.1.12 | 4 / 5 | |
| 0.1.11 | 4 / 5 | |
| 0.1.10 | 4 / 5 | |
| 0.1.9 | 4 / 5 | |
| 0.1.8 | 4 / 5 | |
| 0.1.7 | 4 / 5 | |
| 0.1.6 | 4 / 5 | |
| 0.1.5 | 4 / 5 | |
| 0.1.4 | 4 / 5 | |
| 0.1.3 | 4 / 5 | |
| 0.1.2 | 4 / 5 | |
| 0.1.1 | 4 / 5 | |
| 0.1.0 | 4 / 5 |
v0.2.26
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.2.25
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.2.24
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.2.23
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.2.22
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.2.21
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.2.20
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.2.19
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.2.18
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.2.17
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.2.16
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.2.15
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.2.14
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.2.13
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.2.12
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.2.11
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.2.10
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.2.9
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.2.8
2 findingsThis version was published by a different npm account than previous versions on 2024-04-11. This could indicate a legitimate maintainer transition or an account compromise.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.2.7
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.2.6
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2024-02-01. This could indicate a legitimate maintainer transition or an account compromise.
v0.2.5
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.2.4
2 findingsThis version was published by a different npm account than previous versions on 2023-03-02. This could indicate a legitimate maintainer transition or an account compromise.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.2.3
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.2.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.2.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.2.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.1.21
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2022-11-10. This could indicate a legitimate maintainer transition or an account compromise.
v0.1.20
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.1.19
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.1.18
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.1.17
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.1.16
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2022-07-07. This could indicate a legitimate maintainer transition or an account compromise.
v0.1.15
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.1.14
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2022-06-09. This could indicate a legitimate maintainer transition or an account compromise.
v0.1.13
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.1.12
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2022-04-14. This could indicate a legitimate maintainer transition or an account compromise.
v0.1.11
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.1.10
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.1.9
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.1.8
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2022-02-03. This could indicate a legitimate maintainer transition or an account compromise.
v0.1.7
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2022-01-20. This could indicate a legitimate maintainer transition or an account compromise.
v0.1.6
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2022-01-13. This could indicate a legitimate maintainer transition or an account compromise.
v0.1.5
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2022-01-07. This could indicate a legitimate maintainer transition or an account compromise.
v0.1.4
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.1.3
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2021-11-04. This could indicate a legitimate maintainer transition or an account compromise.
v0.1.2
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2021-10-14. This could indicate a legitimate maintainer transition or an account compromise.
v0.1.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.1.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.