@firebase/performance-compat
The compatibility package of Firebase Performance
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| dependencies | unvetted-dep:@firebase/util | AI (dependencies): @firebase/util is a same-org Firebase dependency; already flagged as accepted risk in phantom-dep finding. No real concern for this package. | ai | |
| publish-pattern | dormant-publish | AI (publish-pattern): Package is published by Google's official Firebase bot (google-wombot) with a long established history. Dormancy likely reflects release cadence changes in the Firebase SDK monorepo, not account takeover. | ai | |
| provenance | publisher-changed | AI (provenance): google-wombot is Google's official Firebase automation bot; transition from individual Google engineer accounts to this bot is standard practice for Firebase SDK releases. | ai | |
| maintainer-change | maintainer-removed | AI (maintainer-change): hiranya911 is a known Firebase team member; removal reflects Google's consolidation of publishing under google-wombot service account, not a takeover. | ai | |
| phantom-deps | phantom-dep:tslib | AI (phantom-deps): tslib is a known implicit runtime dependency for TypeScript-compiled packages; phantom flag is a stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:@firebase/util | AI (phantom-deps): First-party Firebase monorepo dependency used transitively in compat shim; not directly imported by design. | ai | |
| phantom-deps | phantom-dep:@firebase/logger | AI (phantom-deps): First-party Firebase monorepo dependency used transitively in compat shim; not directly imported by design. | ai | |
| bogus-package | bogus-package | AI (bogus-package): Firebase SDK monorepo sub-packages consistently lack keywords and detailed READMEs; this is a structural pattern, not a spam indicator. | ai | |
| provenance | no-provenance | AI (provenance): Published by google-wombot in 2021 era; Sigstore provenance was not yet standard practice for Firebase SDK canary releases. | ai |
Versions (showing 44 of 44)
| Version | Deps | Published |
|---|---|---|
| 0.2.25 | 6 / 6 | |
| 0.2.24 | 6 / 6 | |
| 0.2.23 | 6 / 6 | |
| 0.2.22 | 6 / 6 | |
| 0.2.21 | 6 / 6 | |
| 0.2.20 | 6 / 6 | |
| 0.2.19 | 6 / 6 | |
| 0.2.18 | 6 / 6 | |
| 0.2.17 | 6 / 6 | |
| 0.2.16 | 6 / 6 | |
| 0.2.15 | 6 / 6 | |
| 0.2.14 | 6 / 6 | |
| 0.2.13 | 6 / 6 | |
| 0.2.12 | 6 / 6 | |
| 0.2.11 | 6 / 6 | |
| 0.2.10 | 6 / 6 | |
| 0.2.9 | 6 / 6 | |
| 0.2.8 | 6 / 6 | |
| 0.2.7 | 6 / 6 | |
| 0.2.6 | 6 / 6 | |
| 0.2.5 | 6 / 6 | |
| 0.2.4 | 6 / 6 | |
| 0.2.3 | 6 / 6 | |
| 0.2.2 | 6 / 6 | |
| 0.2.1 | 6 / 6 | |
| 0.2.0 | 6 / 6 | |
| 0.1.17 | 6 / 6 | |
| 0.1.16 | 6 / 6 | |
| 0.1.15 | 6 / 6 | |
| 0.1.14 | 6 / 6 | |
| 0.1.13 | 6 / 6 | |
| 0.1.12 | 6 / 6 | |
| 0.1.11 | 6 / 6 | |
| 0.1.10 | 6 / 6 | |
| 0.1.9 | 6 / 6 | |
| 0.1.8 | 6 / 6 | |
| 0.1.7 | 6 / 6 | |
| 0.1.6 | 6 / 6 | |
| 0.1.5 | 6 / 6 | |
| 0.1.4 | 6 / 6 | |
| 0.1.3 | 6 / 6 | |
| 0.1.2 | 6 / 6 | |
| 0.1.1 | 6 / 6 | |
| 0.1.0 | 6 / 6 |
v0.2.25
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.2.24
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.2.23
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.2.22
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.2.21
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.2.20
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.2.19
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.2.18
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.2.17
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.2.16
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.2.15
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.2.14
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.2.13
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.2.12
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.2.11
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.2.10
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.2.9
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.2.8
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.2.7
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.2.6
2 findingsThis version was published by a different npm account than previous versions on 2024-03-28. This could indicate a legitimate maintainer transition or an account compromise.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.2.5
2 findingsThis version was published by a different npm account than previous versions on 2024-02-01. This could indicate a legitimate maintainer transition or an account compromise.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.2.4
2 findingsThis version was published by a different npm account than previous versions on 2023-03-02. This could indicate a legitimate maintainer transition or an account compromise.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.2.3
2 findingsThis version was published by a different npm account than previous versions on 2023-02-03. This could indicate a legitimate maintainer transition or an account compromise.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.2.2
2 findingsThis version was published by a different npm account than previous versions on 2023-02-02. This could indicate a legitimate maintainer transition or an account compromise.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.2.1
2 findingsThis version was published by a different npm account than previous versions on 2023-01-19. This could indicate a legitimate maintainer transition or an account compromise.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.2.0
2 findingsThis version was published by a different npm account than previous versions on 2022-12-08. This could indicate a legitimate maintainer transition or an account compromise.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.1.17
2 findingsThis version was published by a different npm account than previous versions on 2022-11-10. This could indicate a legitimate maintainer transition or an account compromise.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.1.16
2 findingsThis version was published by a different npm account than previous versions on 2022-10-27. This could indicate a legitimate maintainer transition or an account compromise.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.1.15
2 findingsThis version was published by a different npm account than previous versions on 2022-10-12. This could indicate a legitimate maintainer transition or an account compromise.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.1.14
2 findingsThis version was published by a different npm account than previous versions on 2022-10-11. This could indicate a legitimate maintainer transition or an account compromise.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.1.13
2 findingsThis version was published by a different npm account than previous versions on 2022-10-06. This could indicate a legitimate maintainer transition or an account compromise.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.1.12
2 findingsThis version was published by a different npm account than previous versions on 2022-07-07. This could indicate a legitimate maintainer transition or an account compromise.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.1.11
2 findingsThis version was published by a different npm account than previous versions on 2022-06-23. This could indicate a legitimate maintainer transition or an account compromise.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.1.10
2 findingsThis version was published by a different npm account than previous versions on 2022-06-09. This could indicate a legitimate maintainer transition or an account compromise.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.1.9
2 findingsThis version was published by a different npm account than previous versions on 2022-05-06. This could indicate a legitimate maintainer transition or an account compromise.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.1.8
2 findingsThis version was published by a different npm account than previous versions on 2022-04-14. This could indicate a legitimate maintainer transition or an account compromise.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.1.7
2 findingsThis version was published by a different npm account than previous versions on 2022-03-24. This could indicate a legitimate maintainer transition or an account compromise.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.1.6
2 findingsThis version was published by a different npm account than previous versions on 2022-03-17. This could indicate a legitimate maintainer transition or an account compromise.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.1.5
2 findingsThis version was published by a different npm account than previous versions on 2022-01-07. This could indicate a legitimate maintainer transition or an account compromise.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.1.4
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.1.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.1.2
2 findingsThis version was published by a different npm account than previous versions on 2021-10-14. This could indicate a legitimate maintainer transition or an account compromise.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.1.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.1.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.