@flarehr/cars-calculator
Cars Calculator
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| bogus-package | bogus-package | AI (bogus-package): Private internal component library; sparse metadata is expected for org-scoped packages with long publish history. | ai |
Versions (showing 51 of 598)
| Version | Deps | Published |
|---|---|---|
| 2.95.7888 | 0 / 4 | |
| 2.94.7043 | 0 / 4 | |
| 2.93.4854 | 0 / 4 | |
| 2.93.4706 | 0 / 4 | |
| 2.92.65289 | 0 / 4 | |
| 2.91.58269 | 0 / 4 | |
| 2.90.56957 | 0 / 4 | |
| 2.89.56848 | 0 / 4 | |
| 2.89.56619 | 0 / 4 | |
| 2.89.56614 | 0 / 4 | |
| 2.89.56390 | 0 / 4 | |
| 2.88.50785 | 0 / 4 | |
| 2.87.49534 | 0 / 4 | |
| 2.86.48801 | 0 / 4 | |
| 1.4.65502 | 0 / 4 | |
| 1.4.65427 | 0 / 4 | |
| 1.4.65363 | 0 / 4 | |
| 1.4.65207 | 0 / 4 | |
| 1.4.65153 | 0 / 4 | |
| 1.4.65034 | 0 / 4 | |
| 1.4.64867 | 0 / 4 | |
| 1.4.64739 | 0 / 4 | |
| 1.4.64613 | 0 / 4 | |
| 1.4.64567 | 0 / 4 | |
| 1.4.64494 | 0 / 4 | |
| 1.4.64430 | 0 / 4 | |
| 1.4.64259 | 0 / 4 | |
| 1.4.64072 | 0 / 4 | |
| 1.4.63877 | 0 / 4 | |
| 1.4.63671 | 0 / 4 | |
| 1.4.63513 | 0 / 4 | |
| 1.4.63451 | 0 / 4 | |
| 1.4.63386 | 0 / 4 | |
| 1.4.63190 | 0 / 4 | |
| 1.4.63011 | 0 / 4 | |
| 1.4.62827 | 0 / 4 | |
| 1.4.62652 | 0 / 4 | |
| 1.4.62469 | 0 / 4 | |
| 1.4.62397 | 0 / 4 | |
| 1.4.62332 | 0 / 4 | |
| 1.4.62090 | 0 / 4 | |
| 1.4.61864 | 0 / 4 | |
| 1.4.61705 | 0 / 4 | |
| 1.4.61555 | 0 / 4 | |
| 1.4.61351 | 0 / 4 | |
| 1.4.61277 | 0 / 4 | |
| 1.4.61216 | 0 / 4 | |
| 1.4.61079 | 0 / 4 | |
| 1.4.60872 | 0 / 4 | |
| 1.4.60694 | 0 / 4 | |
| 1.4.60560 | 0 / 4 |
v2.95.7888
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v2.94.7043
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v2.93.4854
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v2.93.4706
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v2.92.65289
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v2.91.58269
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v2.90.56957
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v2.89.56848
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v2.89.56619
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v2.89.56614
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v2.89.56390
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v2.88.50785
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v2.87.49534
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v2.86.48801
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.4.65502
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.4.65427
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.4.65363
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.4.65207
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.4.65153
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.4.65034
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.4.64867
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.4.64739
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.4.64613
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.4.64567
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.4.64494
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.4.64430
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.4.64259
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.4.64072
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.4.63877
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.4.63671
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.4.63513
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.4.63451
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.4.63386
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.4.63190
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.4.63011
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.4.62827
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.4.62652
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.4.62469
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.4.62397
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.4.62332
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.4.62090
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.4.61864
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.4.61705
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.4.61555
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.4.61351
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.4.61277
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.4.61216
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.4.61079
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.4.60872
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.4.60694
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.4.60560
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.