@internetarchive/donation-monthly-portal
The Internet Archive Monthly Portal
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| email-domain | unclaimed-email:mitra.biz | AI (email-domain): Stale maintainer email domain on long-standing trusted org package; no behavioral risk. | ai | |
| dependencies | unvetted-dep:@types/braintree | AI (dependencies): Official type-defs package for braintree, benign. | ai | |
| phantom-deps | phantom-dep:@internetarchive/lazy-loader-service | AI (phantom-deps): Same-org package likely loaded by convention. | ai | |
| phantom-deps | phantom-dep:@types/braintree | AI (phantom-deps): Type-only package loaded by convention, not directly imported. | ai | |
| source-diff | large-new-source-files | AI (source-diff): New files are test artifacts/sourcemaps, not injected code. | ai | |
| publish-pattern | new-deps-added | AI (publish-pattern): New deps are first-party @internetarchive icon/service packages. | ai | |
| maintainer-change | maintainer-added | AI (maintainer-change): Internet Archive org package; new maintainer dhallia consistent with internal team expansion, no other risk signals. | ai | |
| provenance | no-provenance | AI (provenance): Internet Archive org packages consistently lack Sigstore provenance; stable false positive for this package family. | ai | |
| dependencies | unvetted-dep:@internetarchive/donation-form-data-models | AI (dependencies): Same-org @internetarchive scoped dependency; expected for this package family. | ai | |
| dependencies | unvetted-dep:@internetarchive/iaux-notification-toast | AI (dependencies): Same-org @internetarchive scoped dependency; expected for this package family. | ai | |
| dependencies | unvetted-dep:@internetarchive/donation-form-section | AI (dependencies): Same-org @internetarchive scoped dependency; expected for this package family. | ai | |
| dependencies | unvetted-dep:@internetarchive/donation-form | AI (dependencies): Same-org @internetarchive scoped dependency; expected for this package family. | ai | |
| phantom-deps | phantom-dep:@internetarchive/iaux-notification-toast | AI (phantom-deps): Same-org dependency declared in package.json; phantom-dep heuristic is unreliable for re-exported or type-only imports. | ai |
Versions (showing 15 of 15)
| Version | Deps | Published |
|---|---|---|
| 7.7.2 | 11 / 27 | |
| 7.7.1 | 11 / 26 | |
| 7.6.1 | 11 / 26 | |
| 7.0.11 | 6 / 26 | |
| 7.0.10 | 6 / 26 | |
| 7.0.9 | 6 / 26 | |
| 7.0.8 | 6 / 26 | |
| 7.0.7 | 6 / 26 | |
| 7.0.6 | 6 / 26 | |
| 7.0.5 | 6 / 26 | |
| 7.0.4 | 6 / 26 | |
| 7.0.3 | 6 / 26 | |
| 7.0.2 | 6 / 26 | |
| 7.0.1 | 6 / 26 | |
| 7.0.0 | 6 / 26 |
v7.7.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v7.7.1
2 findingsMaintainer email '[email protected]' uses domain 'mitra.biz' which has no DNS records. An attacker could register this domain to hijack the maintainer identity.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.