@grafana/k6-test-builder
k6 test builder
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| dependencies | unvetted-dep:@material-ui/lab | AI (dependencies): Standard MUI v4 lab component; stable dependency for this UI library package. | ai | |
| dependencies | unvetted-dep:@parcel/transformer-svg-react | AI (dependencies): Parcel build tooling dependency; expected for this package's SVG handling. | ai | |
| bogus-package | bogus-package | AI (bogus-package): Grafana-org internal library; sparse metadata is expected for org-internal tooling, not spam. | ai | |
| phantom-deps | phantom-dep:redux | AI (phantom-deps): redux is a transitive peer used via react-redux/reduxjs-toolkit; not directly imported but legitimately declared. | ai | |
| phantom-deps | phantom-dep:@parcel/transformer-svg-react | AI (phantom-deps): Build tool referenced in parcel config, not imported in source; stable false positive. | ai | |
| phantom-deps | phantom-dep:@emotion/react | AI (phantom-deps): Emotion packages are MUI peer deps referenced in config; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:@emotion/styled | AI (phantom-deps): Same as @emotion/react — MUI peer dep, config-only reference. | ai |
Versions (showing 8 of 8)
| Version | Deps | Published |
|---|---|---|
| 0.9.3 | 15 / 42 | |
| 0.9.2 | 13 / 46 | |
| 0.9.1 | 13 / 46 | |
| 0.8.25 | 12 / 45 | |
| 0.8.24 | 12 / 45 | |
| 0.8.22 | 12 / 45 | |
| 0.8.21 | 12 / 45 | |
| 0.8.20 | 12 / 45 |
v0.9.3
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.9.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.9.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.8.25
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.8.24
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.8.22
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.8.21
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.8.20
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.