@intlayer/config Apache-2.0 25 versions

@intlayer/config

npm Repository Homepage

Retrieve Intlayer configurations and manage environment variables for both server-side and client-side environments.

25

Versions

Apache-2.0

License

No

Install Scripts

Missing

Provenance

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures No source commit

Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.

Maintainers

ay.pineau

Keywords

intlayerlayerabstractiondatainternationalizationi18ntypescriptjavascriptjsonfile

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
provenance	no-provenance	AI (provenance): Package has never had provenance attestation; consistent across versions.	ai	2026/05/20
source-diff	obfuscated-file:dist/cjs/configFile/configurationSchema.cjs	AI (source-diff): Minified rolldown build output; content is readable zod schema definitions, not obfuscated malware.	ai	2026/05/19
source-diff	obfuscated-file:dist/cjs/utils/cacheMemory.cjs	AI (source-diff): Minified rolldown build output; content is a cache/hashing utility using node:crypto, no malicious patterns.	ai	2026/05/19
source-diff	obfuscated-file:dist/esm/configFile/configurationSchema.mjs	AI (source-diff): Minified rolldown build output; ESM equivalent of the CJS schema file, clearly legitimate.	ai	2026/05/19
phantom-deps	phantom-dep:defu	AI (phantom-deps): Declared runtime dep used in config merging; phantom-dep heuristic false positive for this package.	ai	2026/05/19
phantom-deps	phantom-dep:json5	AI (phantom-deps): Declared runtime dep for JSON5 config file parsing; phantom-dep heuristic false positive.	ai	2026/05/19
phantom-deps	phantom-dep:dotenv	AI (phantom-deps): Declared runtime dep for env file loading; phantom-dep heuristic false positive.	ai	2026/05/19
source-diff	obfuscated-file:dist/esm/utils/cacheMemory.mjs	AI (source-diff): Minified rolldown build output; ESM equivalent of the CJS cache utility, clearly legitimate.	ai	2026/05/19
provenance	missing-githead	AI (provenance): Active monorepo with frequent releases; gitHead absence likely reflects a CI pipeline change, not a supply-chain risk.	ai	2026/05/16

Versions (showing 25 of 127)

Version	Deps	Published
7.3.6	4 / 8	2025-12-04
7.3.5	4 / 8	2025-12-01
7.3.4	4 / 8	2025-12-01
7.3.3	4 / 8	2025-11-28
7.3.2	4 / 8	2025-11-28
7.3.1	4 / 8	2025-11-25
7.3.0	4 / 8	2025-11-25
7.2.3	4 / 8	2025-11-22
7.2.2	4 / 8	2025-11-22
7.2.0	4 / 8	2025-11-20
7.1.9	4 / 8	2025-11-20
7.1.8	4 / 8	2025-11-19
7.1.7	4 / 8	2025-11-19
7.1.6	4 / 8	2025-11-19
7.1.5	4 / 8	2025-11-18
7.1.4	4 / 8	2025-11-18
7.1.3	4 / 8	2025-11-18
7.1.2	4 / 8	2025-11-18
7.1.1	4 / 8	2025-11-18
7.1.0	4 / 8	2025-11-17
7.0.8	4 / 8	2025-11-10
7.0.7	4 / 8	2025-11-05
7.0.6	4 / 8	2025-11-05
7.0.5	4 / 8	2025-10-31
7.0.4	4 / 8	2025-10-31

v7.3.6

2 findings

HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: ay.pineau.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v7.3.5

2 findings

HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: ay.pineau.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v7.3.4

2 findings

HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: ay.pineau.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v7.3.3

2 findings

HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: ay.pineau.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v7.3.2

2 findings

HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: ay.pineau.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v7.3.1

2 findings

HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: ay.pineau.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v7.3.0

2 findings

HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: ay.pineau.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v7.2.3

2 findings

HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: ay.pineau.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v7.2.2

2 findings

HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: ay.pineau.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v7.2.0

2 findings

HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: ay.pineau.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v7.1.9

2 findings

HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: ay.pineau.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v7.1.8

2 findings

HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: ay.pineau.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v7.1.7

2 findings

HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: ay.pineau.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v7.1.6

2 findings

HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: ay.pineau.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v7.1.5

2 findings

HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: ay.pineau.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v7.1.4

2 findings

HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: ay.pineau.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v7.1.3

2 findings

HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: ay.pineau.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v7.1.2

2 findings

HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: ay.pineau.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v7.1.1

2 findings

HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: ay.pineau.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v7.1.0

2 findings

HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: ay.pineau.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v7.0.8

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v7.0.7

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v7.0.6

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v7.0.5

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v7.0.4

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.