← Home

@formatjs/intl-datetimeformat

npm Repository Homepage
51
Versions
—
License
No
Install Scripts
Verified
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures No source commit

Maintainers

longlhoredonkuluspyrocat

Keywords

datetimeformatformatjsi18nintlpolyfill

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
source-diff obfuscated-file:locale-data/am.js AI (source-diff): Auto-generated locale data JSON for Intl.DateTimeFormat polyfill. Long lines are dense i18n data, not obfuscation. ai
provenance no-provenance AI (provenance): Formatjs packages have not historically used Sigstore provenance; absence is a process gap, not a security indicator for this well-established package. ai
provenance missing-githead AI (provenance): Established formatjs package with clean history; missing gitHead reflects a CI/publish environment change, not a security concern for this package. ai
source-diff obfuscated-file:add-golden-tz.js AI (source-diff): Generated timezone transition data file for Intl.DateTimeFormat polyfill; long lines are pipe-delimited zone records, not obfuscation. ai
source-diff obfuscated-file:locale-data/agq.js AI (source-diff): Generated locale data file for Intl.DateTimeFormat polyfill; long lines are compact JSON locale data, not obfuscation. ai
source-diff obfuscated-file:locale-data/ak.js AI (source-diff): Generated locale data file for Intl.DateTimeFormat polyfill; long lines are compact JSON locale data, not obfuscation. ai
source-diff large-new-source-files AI (source-diff): New files are generated locale and timezone data for a comprehensive Intl polyfill; large file count is expected when adding full locale coverage. ai
source-diff source-size-tripled AI (source-diff): Size increase is due to addition of comprehensive locale data and timezone data files for the Intl.DateTimeFormat polyfill, not injected payloads. ai
source-diff obfuscated-file:add-all-tz.js AI (source-diff): Generated timezone transition data file for Intl.DateTimeFormat polyfill; long lines are pipe-delimited zone records, not obfuscation. Pattern is stable for this package. ai
source-diff obfuscated-file:lib/src/data/all-tz.js AI (source-diff): Generated timezone abbreviation/offset lookup table; compact data encoding is expected for this i18n polyfill package. ai
source-diff obfuscated-file:src/data/all-tz.js AI (source-diff): Generated timezone abbreviation/offset lookup table; compact data encoding is expected for this i18n polyfill package. ai
source-diff obfuscated-file:locale-data/af-NA.js AI (source-diff): Generated locale data file calling __addLocaleData with structured JSON; @generated comment confirms build artifact, not obfuscation. ai
source-diff obfuscated-file:locale-data/af.js AI (source-diff): Generated locale data file calling __addLocaleData with structured JSON; @generated comment confirms build artifact. ai
phantom-deps phantom-dep:@formatjs/intl-localematcher AI (phantom-deps): Same-org dependency declared in package.json; phantom detection is a false positive for monorepo packages that may use it indirectly. ai
bogus-package bogus-package AI (bogus-package): Monorepo package; README and docs live at repo root. Empty index.js is a re-export shim pattern common in FormatJS packages. ai
source-diff obfuscated-file:src/data/all-tz.generated.js AI (source-diff): File is @generated IANA timezone data (abbreviations + offsets). Long lines are data strings, not obfuscation. Consistent with the package's datetime polyfill purpose. ai
provenance publisher-changed AI (provenance): FormatJS migrated to GitHub Actions CI publishing; SLSA provenance attestation confirms legitimate CI/CD pipeline. This transition is permanent and expected for all future versions. ai
publish-pattern dormant-publish AI (publish-pattern): Large OSS monorepo; dormancy periods are normal. SLSA attestation rules out account takeover. ai

Versions (showing 51 of 81)

View all versions
Version Deps Published
7.5.2 2 / 0
7.5.1 2 / 0
7.5.0 2 / 0
7.4.10 2 / 0
7.4.9 2 / 0
7.4.8 2 / 0
7.4.7 2 / 2
7.4.6 2 / 2
7.4.5 2 / 2
7.4.4 2 / 2
7.4.2 2 / 2
7.4.1 2 / 2
7.4.0 2 / 2
7.3.2 2 / 2
7.3.1 3 / 2
7.2.6 3 / 2
7.2.5 4 / 2
7.2.4 4 / 2
7.2.3 4 / 2
7.2.2 4 / 2
7.2.1 4 / 2
7.2.0 4 / 2
7.1.2 4 / 2
7.1.1 4 / 2
7.1.0 4 / 2
7.0.6 4 / 2
7.0.5 4 / 2
7.0.4 4 / 2
7.0.2 4 / 2
7.0.1 4 / 2
7.0.0 4 / 2
6.18.2 4 / 2
6.18.1 4 / 2
6.18.0 4 / 2
6.17.4 4 / 2
6.17.3 4 / 2
6.17.2 4 / 2
6.17.1 3 / 2
6.17.0 3 / 2
6.16.6 3 / 2
6.16.5 3 / 2
6.16.4 3 / 2
6.16.3 3 / 2
6.16.2 3 / 2
6.16.1 3 / 2
6.16.0 3 / 2
6.15.0 3 / 2
6.14.0 3 / 2
6.13.0 3 / 2
6.12.6 3 / 2
6.12.5 3 / 2

v7.5.2

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v7.5.1

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v7.5.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v7.4.10

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.