@formatjs/icu-skeleton-parser
51
Versions
MIT
License
No
Install Scripts
Attested
Provenance
Supply chain provenance
Status for the latest visible version.
SLSA provenance attestation (unverified)
npm registry signatures
No source commit
Maintainers
longlhoredonkuluspyrocat
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| provenance | missing-githead | AI (provenance): FormatJS monorepo package with strong publisher track record; missing gitHead reflects a publish environment change, not a security concern for this well-established package. | ai | |
| provenance | no-provenance | AI (provenance): Established FormatJS ecosystem package with trusted publisher; lack of Sigstore attestation is a process gap, not a security risk for this package. | ai | |
| publish-pattern | new-deps-added | AI (publish-pattern): tslib is a well-known Microsoft-maintained TypeScript helper library; its addition is expected and benign for a TypeScript-compiled FormatJS package. | ai | |
| phantom-deps | phantom-dep:tslib | AI (phantom-deps): tslib is a standard TypeScript runtime helper dependency used implicitly by compiled output; not a direct import but a legitimate declared dependency for this package. | ai | |
| provenance | publisher-changed | AI (provenance): formatjs project migrated to GitHub Actions CI/CD publishing with SLSA provenance attestation; this is a legitimate and documented transition for the formatjs monorepo. | ai | |
| bogus-package | bogus-package | AI (bogus-package): Part of the official formatjs monorepo; sparse metadata (no description, no keywords, inflated semver) is normal for monorepo sub-packages published via CI. SLSA provenance confirms legitimate origin. | ai | |
| npm-metadata | no-description | AI (npm-metadata): Monorepo sub-package from the well-known formatjs org; missing description is a metadata quality issue, not a security signal. | ai |
Versions (showing 51 of 83)
| Version | Deps | Published |
|---|---|---|
| 2.1.11 | 0 / 0 | |
| 2.1.10 | 0 / 0 | |
| 2.1.9 | 0 / 0 | |
| 2.1.8 | 0 / 0 | |
| 2.1.7 | 0 / 0 | |
| 2.1.6 | 0 / 0 | |
| 2.1.5 | 0 / 0 | |
| 2.1.4 | 0 / 0 | |
| 2.1.3 | 1 / 0 | |
| 2.1.2 | 1 / 0 | |
| 2.1.1 | 2 / 0 | |
| 2.1.0 | 2 / 0 | |
| 2.0.8 | 2 / 0 | |
| 2.0.7 | 2 / 0 | |
| 2.0.6 | 2 / 0 | |
| 2.0.5 | 2 / 0 | |
| 2.0.4 | 2 / 0 | |
| 2.0.3 | 2 / 0 | |
| 2.0.2 | 2 / 0 | |
| 2.0.1 | 2 / 0 | |
| 2.0.0 | 2 / 0 | |
| 1.8.16 | 2 / 0 | |
| 1.8.15 | 2 / 0 | |
| 1.8.14 | 2 / 0 | |
| 1.8.13 | 2 / 0 | |
| 1.8.12 | 2 / 0 | |
| 1.8.11 | 2 / 0 | |
| 1.8.10 | 2 / 0 | |
| 1.8.9 | 2 / 0 | |
| 1.8.8 | 2 / 0 | |
| 1.8.7 | 2 / 0 | |
| 1.8.6 | 2 / 0 | |
| 1.8.5 | 2 / 0 | |
| 1.8.4 | 2 / 0 | |
| 1.8.3 | 2 / 0 | |
| 1.8.2 | 2 / 0 | |
| 1.8.1 | 2 / 0 | |
| 1.8.0 | 2 / 0 | |
| 1.7.2 | 2 / 0 | |
| 1.7.1 | 2 / 0 | |
| 1.7.0 | 2 / 0 | |
| 1.6.4 | 2 / 0 | |
| 1.6.3 | 2 / 0 | |
| 1.6.2 | 2 / 0 | |
| 1.6.1 | 2 / 0 | |
| 1.6.0 | 2 / 0 | |
| 1.5.0 | 2 / 0 | |
| 1.4.0 | 2 / 0 | |
| 1.3.18 | 2 / 0 | |
| 1.3.17 | 2 / 0 | |
| 1.3.15 | 2 / 0 |
v2.1.11
1 finding
INFO
Has SLSA provenance attestation
provenance
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.