@indra.ai/deva
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| semgrep | semgrep:base64-decode | AI (semgrep): Used in AES key/IV setup via Node crypto — standard encryption pattern, not obfuscation. | ai | |
| semgrep | semgrep:hex-decode | AI (semgrep): Used to decode ciphertext in AES decryption routine — legitimate crypto usage. | ai |
Versions (showing 51 of 230)
| Version | Deps | Published |
|---|---|---|
| 1.37.3 | 0 / 0 | |
| 1.37.2 | 0 / 0 | |
| 1.37.1 | 0 / 0 | |
| 1.37.0 | 0 / 0 | |
| 1.36.0 | 0 / 0 | |
| 1.35.1 | 0 / 0 | |
| 1.35.0 | 0 / 0 | |
| 1.34.0 | 0 / 0 | |
| 1.33.1 | 0 / 0 | |
| 1.33.0 | 0 / 0 | |
| 1.32.0 | 0 / 0 | |
| 1.31.0 | 0 / 0 | |
| 1.30.2 | 0 / 0 | |
| 1.30.0 | 0 / 0 | |
| 1.29.33 | 0 / 0 | |
| 1.29.32 | 0 / 0 | |
| 1.29.31 | 0 / 0 | |
| 1.29.30 | 0 / 0 | |
| 1.29.29 | 0 / 0 | |
| 1.29.28 | 0 / 0 | |
| 1.29.27 | 0 / 0 | |
| 1.29.26 | 0 / 0 | |
| 1.29.25 | 0 / 0 | |
| 1.29.24 | 0 / 0 | |
| 1.29.23 | 0 / 0 | |
| 1.29.22 | 0 / 0 | |
| 1.29.21 | 0 / 0 | |
| 1.29.20 | 0 / 0 | |
| 1.29.19 | 0 / 0 | |
| 1.29.18 | 0 / 0 | |
| 1.29.17 | 0 / 0 | |
| 1.29.16 | 0 / 0 | |
| 1.29.15 | 0 / 0 | |
| 1.29.14 | 0 / 0 | |
| 1.29.13 | 0 / 0 | |
| 1.29.12 | 0 / 0 | |
| 1.29.11 | 0 / 0 | |
| 1.29.10 | 0 / 0 | |
| 1.29.9 | 0 / 0 | |
| 1.29.8 | 0 / 0 | |
| 1.29.7 | 0 / 0 | |
| 1.29.6 | 0 / 0 | |
| 1.29.5 | 0 / 0 | |
| 1.29.4 | 0 / 0 | |
| 1.29.3 | 0 / 0 | |
| 1.29.2 | 0 / 0 | |
| 1.29.1 | 0 / 0 | |
| 1.29.0 | 0 / 0 | |
| 1.28.2 | 0 / 0 | |
| 1.28.1 | 0 / 0 | |
| 1.28.0 | 0 / 0 |
v1.37.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.37.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.37.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.36.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.35.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.35.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.34.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.33.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.33.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.32.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.31.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.30.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.30.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.29.33
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.29.32
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.29.31
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.29.30
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.29.29
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.29.28
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.29.27
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.29.26
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.29.25
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.29.24
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.29.23
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.29.22
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.29.21
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.29.20
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.29.19
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.29.18
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.29.17
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.29.16
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.29.15
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.29.14
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.29.13
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.29.12
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.29.11
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.29.10
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.29.9
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.29.8
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.29.7
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.29.6
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.29.5
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.29.4
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.29.3
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.29.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.29.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.29.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.28.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.28.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.28.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.