@internetarchive/field-parsers
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| publish-pattern | dormant-publish | AI (publish-pattern): Internet Archive org package; long dormancy followed by tooling update is consistent with legitimate maintenance cadence. | ai | |
| maintainer-change | maintainer-added | AI (maintainer-change): dhallia added under the Internet Archive org; consistent with normal team expansion for an established org package. | ai |
v1.1.0
3 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: jbuckner.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (jbuckner) than the most recent previously approved version (latonv) on 2026-07-02, but jbuckner is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.