← Home

@imtbl/passport

npm Repository Homepage

Passport module for Immutable SDK

27
Versions
Apache-2.0
License
No
Install Scripts
Verified
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures No source commit

Maintainers

tcurtin88alex-immutableimmutable-npm

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
dependencies unvetted-dep:@imtbl/x-provider AI (dependencies): Internal monorepo sibling package from same trusted publisher; versioned in lockstep. ai
dependencies unvetted-dep:@imtbl/x-client AI (dependencies): Internal monorepo sibling package from same trusted publisher; versioned in lockstep. ai
provenance publisher-changed AI (provenance): Transition to GitHub Actions CI publishing with SLSA attestation; consistent with org-wide CI/CD migration for this monorepo. ai
maintainer-change maintainer-removed AI (maintainer-change): platform-sa removal aligns with GitHub Actions takeover of publishing; SLSA attestation confirms legitimate CI pipeline. ai
phantom-deps phantom-dep:@magic-sdk/provider AI (phantom-deps): Referenced in config files only; stable FP for this bundled SDK package. ai
phantom-deps phantom-dep:magic-sdk AI (phantom-deps): SDK dependency referenced via config/peer pattern, not direct import; stable FP for this package. ai
phantom-deps phantom-dep:@magic-ext/oidc AI (phantom-deps): Referenced in config files only; stable FP for this bundled SDK package. ai
phantom-deps phantom-dep:@metamask/detect-provider AI (phantom-deps): Referenced in config files only; stable FP for this bundled SDK package. ai
phantom-deps phantom-dep:ethers AI (phantom-deps): Declared runtime dep used via config/re-export; stable false positive for this monorepo SDK package. ai
phantom-deps phantom-dep:oidc-client-ts AI (phantom-deps): Declared runtime dep used via config/re-export; stable false positive for this monorepo SDK package. ai
phantom-deps phantom-dep:@imtbl/toolkit AI (phantom-deps): Same-org sibling dep; phantom-dep heuristic unreliable for monorepo internal packages. ai
phantom-deps phantom-dep:localforage AI (phantom-deps): Declared runtime dep used via config/re-export; stable false positive for this monorepo SDK package. ai

Versions (showing 27 of 27)

Version Deps Published
2.23.0 5 / 19
2.22.0 9 / 19
2.21.0 9 / 19
2.20.2 9 / 19
2.20.1 9 / 19
2.20.0 9 / 19
2.19.0 9 / 19
2.18.0 9 / 19
2.17.1 9 / 19
2.17.0 9 / 19
2.16.0 9 / 19
2.15.0 9 / 19
2.12.7 11 / 19
2.12.2 11 / 19
2.12.1 11 / 19
2.12.0 11 / 19
2.11.0 19 / 20
2.10.6 19 / 20
2.10.5 19 / 20
2.10.4 19 / 20
2.10.1 19 / 20
2.7.2 19 / 20
2.4.14 19 / 20
2.4.8 19 / 20
2.4.5 19 / 20
2.4.3 19 / 20
2.2.4 19 / 20

v2.23.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v2.22.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v2.21.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v2.20.2

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.