@fncts/base
Supply chain provenance
Status for the latest visible version.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| provenance | missing-githead | AI (provenance): Package now publishes via CI with SLSA provenance; gitHead absence is expected in this workflow. | ai | |
| publish-pattern | dormant-publish | AI (publish-pattern): SLSA provenance attestation and clean publisher history make account-takeover unlikely; dormancy is benign here. | ai | |
| bogus-package | bogus-package | AI (bogus-package): Established functional library in @fncts scope; empty CJS entry and missing metadata are a build artifact, not spam indicators. | ai |
Versions (showing 10 of 10)
| Version | Deps | Published |
|---|---|---|
| 0.0.44 | 2 / 0 | |
| 0.0.43 | 2 / 0 | |
| 0.0.42 | 2 / 0 | |
| 0.0.41 | 2 / 0 | |
| 0.0.40 | 2 / 0 | |
| 0.0.39 | 2 / 0 | |
| 0.0.38 | 2 / 0 | |
| 0.0.37 | 2 / 0 | |
| 0.0.36 | 2 / 0 | |
| 0.0.35 | 2 / 0 |
v0.0.40
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.39
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.38
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.37
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.36
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.0.35
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.