← Home

@imtbl/toolkit

npm Repository Homepage

Provider package for Immutable SDK

15
Versions
Apache-2.0
License
No
Install Scripts
Verified
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures No source commit

Maintainers

tcurtin88alex-immutableimmutable-npm

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
provenance publisher-changed AI (provenance): Immutable SDK migrated publishing to GitHub Actions CI with SLSA attestation; this is the expected new publisher for all future versions. ai
maintainer-change maintainer-removed AI (maintainer-change): platform-sa removal is consistent with the CI/CD migration to GitHub Actions; not a takeover signal given SLSA attestation. ai
bogus-package bogus-package AI (bogus-package): Internal SDK sub-package; sparse README and no keywords are expected for this package family. ai
phantom-deps phantom-dep:magic-sdk AI (phantom-deps): Declared as runtime dep; phantom-dep heuristic fires because it's re-exported rather than directly imported. ai
phantom-deps phantom-dep:@magic-ext/oidc AI (phantom-deps): Same re-export pattern as other accepted phantom-deps in this package. ai
phantom-deps phantom-dep:oidc-client-ts AI (phantom-deps): Same re-export/toolkit pattern; stable false positive for this package. ai
phantom-deps phantom-dep:ethers AI (phantom-deps): Same re-export/toolkit pattern; stable false positive for this package. ai
phantom-deps phantom-dep:@metamask/detect-provider AI (phantom-deps): Same re-export/toolkit pattern; stable false positive for this package. ai
phantom-deps phantom-dep:axios AI (phantom-deps): Toolkit re-export package; deps declared for consumers, not directly imported in source. ai

Versions (showing 15 of 15)

Version Deps Published
2.22.0 6 / 17
2.21.0 6 / 17
2.20.2 6 / 17
2.20.1 6 / 17
2.20.0 6 / 17
2.19.0 6 / 17
2.18.0 6 / 17
2.17.1 6 / 17
2.17.0 6 / 17
2.16.0 6 / 17
2.15.0 6 / 17
2.12.4 7 / 17
2.12.0 7 / 17
2.10.4 9 / 17
0.1.0 6 / 17

v2.22.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v2.21.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v2.20.2

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.1.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.