@golemio/core
15
Versions
—
License
No
Install Scripts
Missing
Provenance
Supply chain provenance
Status for the latest visible version.
No SLSA provenance
npm registry signatures
gitHead linked
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
sinacekbenaktomoict-robot
Keywords
golemio
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| dependencies | unvetted-dep:sequelize | AI (dependencies): sequelize is a well-known, widely-used ORM; stable false positive for this package. | ai | |
| publish-pattern | new-deps-added | AI (publish-pattern): @opensearch-project/opensearch is the official OpenSearch JS client; low-risk addition for this established package. | ai | |
| phantom-deps | phantom-dep:@types/qs | AI (phantom-deps): @types packages declared as runtime deps for TypeScript consumers; not directly imported by convention. | ai | |
| publish-pattern | rapid-publish | AI (publish-pattern): CI/CD pipeline with 1083 versions; rapid successive publishes are expected for automated releases. | ai | |
| phantom-deps | phantom-dep:@types/luxon | AI (phantom-deps): @types packages declared as runtime deps for TypeScript consumers; not directly imported by convention. | ai | |
| phantom-deps | phantom-dep:@types/amqplib | AI (phantom-deps): @types packages declared as runtime deps for TypeScript consumers; not directly imported by convention. | ai | |
| phantom-deps | phantom-dep:@types/express | AI (phantom-deps): @types packages declared as runtime deps for TypeScript consumers; not directly imported by convention. | ai | |
| phantom-deps | phantom-dep:@types/geojson | AI (phantom-deps): @types packages declared as runtime deps for TypeScript consumers; not directly imported by convention. | ai | |
| phantom-deps | phantom-dep:dotenv | AI (phantom-deps): dotenv loaded via test scripts, not direct import; stable false positive. | ai | |
| phantom-deps | phantom-dep:fast-glob | AI (phantom-deps): Used in build/config context; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:pino-pretty | AI (phantom-deps): Dev/logging utility loaded by convention; stable false positive. | ai | |
| phantom-deps | phantom-dep:apicache-plus | AI (phantom-deps): Loaded by framework convention; stable false positive. | ai | |
| phantom-deps | phantom-dep:pg | AI (phantom-deps): pg is a common optional DB driver declared for downstream use; stable false positive for this package. | ai | |
| typosquat | typosquat.levenshtein:cors | AI (typosquat): Scoped @golemio/core is a long-established internal framework package, not a typosquat of 'cors'. | ai |
Versions (showing 15 of 15)
| Version | Deps | Published |
|---|---|---|
| 3.3.0 | 58 / 38 | |
| 3.2.1 | 58 / 38 | |
| 3.2.0 | 58 / 38 | |
| 3.1.1 | 59 / 37 | |
| 3.1.0 | 59 / 37 | |
| 3.0.7 | 59 / 36 | |
| 3.0.6 | 59 / 36 | |
| 3.0.5 | 59 / 36 | |
| 3.0.4 | 59 / 36 | |
| 3.0.2 | 59 / 36 | |
| 3.0.1 | 59 / 36 | |
| 3.0.0 | 59 / 36 | |
| 2.0.4 | 59 / 36 | |
| 2.0.3 | 59 / 36 | |
| 2.0.2 | 59 / 36 |
v3.3.0
1 finding
LOW
No provenance attestation
provenance
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.