@forestadmin/datasource-mongo No license 52 versions

@forestadmin/datasource-mongo

npm Repository Homepage

52

Versions

—

License

No

Install Scripts

Verified

Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures gitHead linked

Maintainers

pmerletforestbot

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
maintainer-change	maintainer-added	AI (maintainer-change): Trusted CI bot account (forestbot) used across the ForestAdmin org, long stable track record.	ai	2026/07/19
provenance	publisher-changed-stale	AI (provenance): Stale publisher change, 536d unremoved, consistent with legitimate org automation not takeover.	ai	2026/07/19
publish-pattern	dormant-publish	AI (publish-pattern): Dormancy explained by no-op diff release; not a behavior change.	ai	2026/07/19
npm-metadata	no-description	AI (npm-metadata): Established ForestAdmin scoped package; missing description is a cosmetic issue, not a malice indicator.	ai	2026/05/29
phantom-deps	phantom-dep:json-stringify-pretty-compact	AI (phantom-deps): json-stringify-pretty-compact is a declared runtime dep in package.json; phantom-dep heuristic is a stable false positive here.	ai	2026/05/29

Versions (showing 52 of 52)

Version	Deps	Published
1.6.10	5 / 0	2026-07-24
1.6.9	5 / 0	2026-04-14
1.6.8	5 / 0	2026-03-31
1.6.7	5 / 0	2026-03-18
1.6.6	5 / 0	2026-02-25
1.6.5	5 / 0	2026-02-24
1.6.4	5 / 0	2026-02-20
1.6.3	5 / 0	2026-02-12
1.6.2	5 / 0	2026-01-22
1.6.1	5 / 0	2026-01-06
1.6.0	5 / 0	2025-12-18
1.5.4	5 / 0	2025-08-28
1.5.3	5 / 0	2025-05-21
1.5.2	5 / 0	2025-05-12
1.5.1	5 / 0	2025-05-07
1.5.0	5 / 0	2025-04-15
1.4.8	5 / 0	2025-03-19
1.4.7	5 / 0	2025-03-11
1.4.6	5 / 0	2025-02-24
1.4.5	5 / 0	2025-02-21
1.4.4	5 / 0	2025-02-05
1.4.3	5 / 0	2025-01-29
1.4.2	5 / 0	2025-01-28
1.4.1	5 / 0	2025-01-23
1.4.0	5 / 0	2025-01-22
1.3.31	5 / 0	2025-01-22
1.3.30	5 / 0	2025-01-02
1.3.29	5 / 0	2025-01-02
1.3.28	5 / 0	2024-12-18
1.3.27	5 / 0	2024-12-18
1.3.26	5 / 0	2024-11-27
1.3.25	5 / 0	2024-10-18
1.3.24	5 / 0	2024-10-10
1.3.23	5 / 0	2024-10-07
1.3.22	5 / 0	2024-10-04
1.3.21	5 / 0	2024-10-04
1.3.20	5 / 0	2024-09-27
1.3.19	5 / 0	2024-09-25
1.3.18	5 / 0	2024-09-23
1.3.17	5 / 0	2024-09-18
1.3.16	5 / 0	2024-09-17
1.3.15	5 / 0	2024-09-17
1.3.14	5 / 0	2024-09-09
1.3.13	5 / 0	2024-08-21
1.3.12	5 / 0	2024-07-16
1.3.11	5 / 0	2024-07-15
1.3.10	5 / 0	2024-07-11
1.3.9	5 / 0	2024-07-09
1.3.8	5 / 0	2024-07-09
1.3.7	5 / 0	2024-07-04
1.3.6	5 / 0	2024-06-19
1.3.5	5 / 0	2024-05-21

v1.6.10

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.5.2

2 findings

MEDIUM Publisher changed: arnaudbesnier → forestbot (on 2025-05-12, unremoved on npm for 432d) provenance

This version was published by a different npm account (forestbot) than the most recent previously approved version (arnaudbesnier) on 2025-05-12. It has since remained available on npm for 432 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.5.1

2 findings

MEDIUM Publisher changed: arnaudbesnier → forestbot (on 2025-05-07, unremoved on npm for 437d) provenance

This version was published by a different npm account (forestbot) than the most recent previously approved version (arnaudbesnier) on 2025-05-07. It has since remained available on npm for 437 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.5.0

2 findings

MEDIUM Publisher changed: arnaudbesnier → forestbot (on 2025-04-15, unremoved on npm for 459d) provenance

This version was published by a different npm account (forestbot) than the most recent previously approved version (arnaudbesnier) on 2025-04-15. It has since remained available on npm for 459 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.4.8

2 findings

MEDIUM Publisher changed: arnaudbesnier → forestbot (on 2025-03-19, unremoved on npm for 486d) provenance

This version was published by a different npm account (forestbot) than the most recent previously approved version (arnaudbesnier) on 2025-03-19. It has since remained available on npm for 486 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.4.7

2 findings

MEDIUM Publisher changed: arnaudbesnier → forestbot (on 2025-03-11, unremoved on npm for 494d) provenance

This version was published by a different npm account (forestbot) than the most recent previously approved version (arnaudbesnier) on 2025-03-11. It has since remained available on npm for 494 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.4.6

2 findings

MEDIUM Publisher changed: arnaudbesnier → forestbot (on 2025-02-24, unremoved on npm for 509d) provenance

This version was published by a different npm account (forestbot) than the most recent previously approved version (arnaudbesnier) on 2025-02-24. It has since remained available on npm for 509 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.4.5

2 findings

MEDIUM Publisher changed: arnaudbesnier → forestbot (on 2025-02-21, unremoved on npm for 512d) provenance

This version was published by a different npm account (forestbot) than the most recent previously approved version (arnaudbesnier) on 2025-02-21. It has since remained available on npm for 512 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.4.4

2 findings

MEDIUM Publisher changed: arnaudbesnier → forestbot (on 2025-02-05, unremoved on npm for 528d) provenance

This version was published by a different npm account (forestbot) than the most recent previously approved version (arnaudbesnier) on 2025-02-05. It has since remained available on npm for 528 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.4.3

2 findings

MEDIUM Publisher changed: arnaudbesnier → forestbot (on 2025-01-29, unremoved on npm for 535d) provenance

This version was published by a different npm account (forestbot) than the most recent previously approved version (arnaudbesnier) on 2025-01-29. It has since remained available on npm for 535 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.4.2

2 findings

MEDIUM Publisher changed: arnaudbesnier → forestbot (on 2025-01-28, unremoved on npm for 536d) provenance

This version was published by a different npm account (forestbot) than the most recent previously approved version (arnaudbesnier) on 2025-01-28. It has since remained available on npm for 536 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.4.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.4.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.3.31

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.3.30

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.3.29

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.3.28

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.3.27

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.3.26

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.3.25

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.3.24

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.3.23

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.3.22

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.3.21

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.3.20

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.3.19

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.3.18

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.3.17

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.3.16

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.3.15

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.3.14

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.3.13

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.3.12

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.3.11

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.3.10

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.3.9

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.3.8

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.3.7

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.3.6

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.3.5

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.