@forestadmin/datasource-sql
Supply chain provenance
Status for the latest visible version.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| maintainer-change | maintainer-added | AI (maintainer-change): forestbot is ForestAdmin's established internal publishing account, 645 approved packages. | ai | |
| publish-pattern | dormant-publish | AI (publish-pattern): Explained by long-lived stable publisher switch, not takeover; no material code change. | ai | |
| source-diff | obfuscated-file-transition:dist/index.js | AI (source-diff): False positive: >3000-char line is the tsc inline base64 sourcemap, not obfuscation; JS is readable. | ai | |
| phantom-deps | phantom-dep:@types/ssh2 | AI (phantom-deps): @types/ssh2 is a type companion to the ssh2 runtime dep; stable false positive for this package. | ai |
Versions (showing 54 of 54)
| Version | Deps | Published |
|---|---|---|
| 1.17.11 | 7 / 0 | |
| 1.17.10 | 7 / 0 | |
| 1.17.9 | 7 / 0 | |
| 1.17.8 | 7 / 0 | |
| 1.17.7 | 7 / 0 | |
| 1.17.6 | 7 / 0 | |
| 1.17.5 | 7 / 0 | |
| 1.17.4 | 7 / 0 | |
| 1.17.3 | 7 / 0 | |
| 1.17.2 | 7 / 0 | |
| 1.17.1 | 7 / 0 | |
| 1.17.0 | 7 / 0 | |
| 1.16.10 | 7 / 0 | |
| 1.16.9 | 7 / 0 | |
| 1.16.8 | 7 / 0 | |
| 1.16.7 | 7 / 0 | |
| 1.16.6 | 7 / 0 | |
| 1.16.5 | 7 / 0 | |
| 1.16.4 | 7 / 0 | |
| 1.16.3 | 7 / 0 | |
| 1.16.2 | 7 / 0 | |
| 1.16.1 | 7 / 0 | |
| 1.16.0 | 7 / 0 | |
| 1.15.0 | 7 / 0 | |
| 1.14.31 | 7 / 0 | |
| 1.14.30 | 7 / 0 | |
| 1.14.29 | 7 / 0 | |
| 1.14.28 | 7 / 0 | |
| 1.14.27 | 7 / 0 | |
| 1.14.26 | 7 / 0 | |
| 1.14.25 | 7 / 0 | |
| 1.14.24 | 7 / 0 | |
| 1.14.23 | 7 / 0 | |
| 1.14.22 | 7 / 0 | |
| 1.14.21 | 7 / 0 | |
| 1.14.20 | 7 / 0 | |
| 1.14.19 | 7 / 0 | |
| 1.14.18 | 7 / 0 | |
| 1.14.17 | 7 / 0 | |
| 1.14.16 | 7 / 0 | |
| 1.14.15 | 7 / 0 | |
| 1.14.14 | 7 / 0 | |
| 1.14.13 | 7 / 0 | |
| 1.14.12 | 7 / 0 | |
| 1.14.11 | 7 / 0 | |
| 1.14.10 | 7 / 0 | |
| 1.14.9 | 7 / 0 | |
| 1.14.8 | 7 / 0 | |
| 1.14.7 | 7 / 0 | |
| 1.14.6 | 7 / 0 | |
| 1.14.5 | 7 / 0 | |
| 1.14.4 | 7 / 0 | |
| 1.14.3 | 7 / 0 | |
| 1.14.2 | 7 / 0 |
v1.17.11
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.17.9
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.17.8
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.17.7
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.17.6
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.17.5
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.17.4
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.17.2
3 findingsThis file was readable in the previously greenflagged version and is now minified or obfuscated (lines over 3000 chars). A file that gains obfuscation between releases is a strong payload-swap indicator.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
This version was published by a different npm account (GitHub Actions) than the most recent previously approved version (arnaudbesnier) on 2026-01-06, but it carries Sigstore provenance attestation. This means the package moved to a trusted publisher (CI/CD with OIDC, e.g. GitHub Actions) — a supply-chain integrity improvement, not a compromise, since a stolen npm token cannot forge provenance bound to the source repository. Recorded as INFO for audit trail.
v1.17.1
3 findingsThis file was readable in the previously greenflagged version and is now minified or obfuscated (lines over 3000 chars). A file that gains obfuscation between releases is a strong payload-swap indicator.
This version was published by a different npm account (forestbot) than the most recent previously approved version (arnaudbesnier) on 2025-05-14. It has since remained available on npm for 433 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.17.0
3 findingsThis file was readable in the previously greenflagged version and is now minified or obfuscated (lines over 3000 chars). A file that gains obfuscation between releases is a strong payload-swap indicator.
This version was published by a different npm account (forestbot) than the most recent previously approved version (arnaudbesnier) on 2025-04-15. It has since remained available on npm for 462 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.16.10
3 findingsThis file was readable in the previously greenflagged version and is now minified or obfuscated (lines over 3000 chars). A file that gains obfuscation between releases is a strong payload-swap indicator.
This version was published by a different npm account (forestbot) than the most recent previously approved version (arnaudbesnier) on 2025-03-11. It has since remained available on npm for 497 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.16.9
3 findingsThis file was readable in the previously greenflagged version and is now minified or obfuscated (lines over 3000 chars). A file that gains obfuscation between releases is a strong payload-swap indicator.
This version was published by a different npm account (forestbot) than the most recent previously approved version (arnaudbesnier) on 2025-03-11. It has since remained available on npm for 497 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.16.8
3 findingsThis file was readable in the previously greenflagged version and is now minified or obfuscated (lines over 3000 chars). A file that gains obfuscation between releases is a strong payload-swap indicator.
This version was published by a different npm account (forestbot) than the most recent previously approved version (arnaudbesnier) on 2025-02-21. It has since remained available on npm for 515 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.16.7
3 findingsThis file was readable in the previously greenflagged version and is now minified or obfuscated (lines over 3000 chars). A file that gains obfuscation between releases is a strong payload-swap indicator.
This version was published by a different npm account (forestbot) than the most recent previously approved version (arnaudbesnier) on 2025-02-05. It has since remained available on npm for 531 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.16.6
3 findingsThis file was readable in the previously greenflagged version and is now minified or obfuscated (lines over 3000 chars). A file that gains obfuscation between releases is a strong payload-swap indicator.
This version was published by a different npm account (forestbot) than the most recent previously approved version (arnaudbesnier) on 2025-01-28. It has since remained available on npm for 539 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.16.5
2 findingsThis file was readable in the previously greenflagged version and is now minified or obfuscated (lines over 3000 chars). A file that gains obfuscation between releases is a strong payload-swap indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.16.4
2 findingsThis file was readable in the previously greenflagged version and is now minified or obfuscated (lines over 3000 chars). A file that gains obfuscation between releases is a strong payload-swap indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.16.3
2 findingsThis file was readable in the previously greenflagged version and is now minified or obfuscated (lines over 3000 chars). A file that gains obfuscation between releases is a strong payload-swap indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.16.2
2 findingsThis file was readable in the previously greenflagged version and is now minified or obfuscated (lines over 3000 chars). A file that gains obfuscation between releases is a strong payload-swap indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.16.1
2 findingsThis file was readable in the previously greenflagged version and is now minified or obfuscated (lines over 3000 chars). A file that gains obfuscation between releases is a strong payload-swap indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.16.0
2 findingsThis file was readable in the previously greenflagged version and is now minified or obfuscated (lines over 3000 chars). A file that gains obfuscation between releases is a strong payload-swap indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.15.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.14.31
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.14.30
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.14.29
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.14.28
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.14.27
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.14.26
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.14.25
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.14.24
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.14.23
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.14.22
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.14.21
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.14.20
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.14.19
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.14.18
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.14.17
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.14.16
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.14.15
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.14.14
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.14.13
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.14.12
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.14.11
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.14.10
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.14.9
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.14.8
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.14.7
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.14.6
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.14.5
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.14.4
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.14.3
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.14.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.