@forestadmin/datasource-customizer
Supply chain provenance
Status for the latest visible version.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | obfuscated-file:dist/decorators/lazy-join/collection.js | AI (source-diff): Compiled TypeScript output, not true obfuscation; long line is a minifier/tsc artifact. | ai | |
| provenance | publisher-changed-stale | AI (provenance): Long-stale publisher change on established, widely-used ForestAdmin package; not takeover pattern. | ai |
Versions (showing 57 of 57)
| Version | Deps | Published |
|---|---|---|
| 1.70.0 | 6 / 3 | |
| 1.69.3 | 6 / 3 | |
| 1.69.2 | 6 / 3 | |
| 1.69.1 | 6 / 3 | |
| 1.69.0 | 6 / 3 | |
| 1.68.2 | 6 / 3 | |
| 1.68.1 | 6 / 3 | |
| 1.68.0 | 6 / 3 | |
| 1.67.4 | 6 / 3 | |
| 1.67.3 | 6 / 3 | |
| 1.67.2 | 6 / 3 | |
| 1.67.1 | 6 / 3 | |
| 1.67.0 | 6 / 3 | |
| 1.66.0 | 6 / 3 | |
| 1.65.1 | 6 / 3 | |
| 1.65.0 | 6 / 3 | |
| 1.64.0 | 6 / 3 | |
| 1.63.1 | 6 / 3 | |
| 1.63.0 | 6 / 3 | |
| 1.62.0 | 6 / 3 | |
| 1.61.3 | 6 / 3 | |
| 1.61.2 | 6 / 3 | |
| 1.61.1 | 6 / 3 | |
| 1.61.0 | 6 / 3 | |
| 1.60.0 | 6 / 3 | |
| 1.59.0 | 6 / 3 | |
| 1.58.0 | 6 / 3 | |
| 1.57.1 | 6 / 3 | |
| 1.57.0 | 6 / 3 | |
| 1.56.0 | 6 / 3 | |
| 1.55.5 | 6 / 3 | |
| 1.55.4 | 6 / 3 | |
| 1.55.3 | 6 / 3 | |
| 1.55.2 | 6 / 3 | |
| 1.55.1 | 6 / 3 | |
| 1.55.0 | 6 / 3 | |
| 1.54.1 | 6 / 3 | |
| 1.54.0 | 6 / 3 | |
| 1.53.0 | 6 / 3 | |
| 1.52.1 | 6 / 3 | |
| 1.52.0 | 6 / 3 | |
| 1.51.0 | 6 / 3 | |
| 1.50.0 | 6 / 3 | |
| 1.49.0 | 6 / 3 | |
| 1.48.0 | 6 / 3 | |
| 1.47.2 | 6 / 3 | |
| 1.47.1 | 6 / 3 | |
| 1.47.0 | 6 / 3 | |
| 1.46.1 | 6 / 3 | |
| 1.46.0 | 6 / 3 | |
| 1.45.6 | 6 / 3 | |
| 1.45.5 | 6 / 3 | |
| 1.45.4 | 6 / 3 | |
| 1.45.3 | 6 / 3 | |
| 1.45.2 | 6 / 3 | |
| 1.45.1 | 6 / 3 | |
| 1.45.0 | 6 / 3 |
v1.70.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.66.0
3 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
This version was published by a different npm account (forestbot) than the most recent previously approved version (arnaudbesnier) on 2025-05-06. It has since remained available on npm for 438 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.65.1
3 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
This version was published by a different npm account (forestbot) than the most recent previously approved version (arnaudbesnier) on 2025-04-16. It has since remained available on npm for 458 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.65.0
3 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
This version was published by a different npm account (forestbot) than the most recent previously approved version (arnaudbesnier) on 2025-04-15. It has since remained available on npm for 459 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.64.0
3 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
This version was published by a different npm account (forestbot) than the most recent previously approved version (arnaudbesnier) on 2025-03-26. It has since remained available on npm for 479 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.63.1
3 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
This version was published by a different npm account (forestbot) than the most recent previously approved version (arnaudbesnier) on 2025-03-11. It has since remained available on npm for 494 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.63.0
3 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
This version was published by a different npm account (forestbot) than the most recent previously approved version (arnaudbesnier) on 2025-02-21. It has since remained available on npm for 512 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.62.0
3 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
This version was published by a different npm account (forestbot) than the most recent previously approved version (arnaudbesnier) on 2025-02-14. It has since remained available on npm for 519 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.61.3
3 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
This version was published by a different npm account (forestbot) than the most recent previously approved version (arnaudbesnier) on 2025-02-05. It has since remained available on npm for 528 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.61.2
3 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
This version was published by a different npm account (forestbot) than the most recent previously approved version (arnaudbesnier) on 2025-01-28. It has since remained available on npm for 536 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.61.1
3 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
This version was published by a different npm account (forestbot) than the most recent previously approved version (arnaudbesnier) on 2025-01-24. It has since remained available on npm for 540 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.61.0
3 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
This version was published by a different npm account (forestbot) than the most recent previously approved version (arnaudbesnier) on 2025-01-23. It has since remained available on npm for 541 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.60.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.59.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.58.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.57.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.57.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.56.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.55.5
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.55.4
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.55.3
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.55.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.55.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.55.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.54.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.54.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.53.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.52.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.52.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.51.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.50.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.49.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.48.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.47.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.47.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.47.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.46.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.46.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.45.6
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.45.5
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.45.4
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.45.3
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.45.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.45.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.45.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.