@ionic/utils-process
Supply chain provenance
Status for the latest visible version.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| bogus-package | bogus-package | AI (bogus-package): Internal utility package in the ionic-cli monorepo; sparse README and no keywords are expected for this type of package and stable across versions. | ai | |
| dependencies | unvetted-dep:@ionic/utils-object | AI (dependencies): First-party Ionic dependency from the same ionic-cli monorepo; no security concern. | ai |
Versions (showing 16 of 16)
| Version | Deps | Published |
|---|---|---|
| 2.1.12 | 6 / 10 | |
| 2.1.11 | 6 / 10 | |
| 2.1.10 | 6 / 10 | |
| 2.1.9 | 6 / 10 | |
| 2.1.8 | 6 / 10 | |
| 2.1.7 | 6 / 10 | |
| 2.1.6 | 6 / 10 | |
| 2.1.5 | 7 / 12 | |
| 2.1.4 | 6 / 11 | |
| 2.1.3 | 6 / 11 | |
| 2.1.2 | 6 / 11 | |
| 2.1.1 | 6 / 11 | |
| 2.1.0 | 6 / 11 | |
| 2.0.2 | 6 / 11 | |
| 2.0.1 | 6 / 11 | |
| 2.0.0 | 6 / 11 |
v2.1.11
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.1.10
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.1.9
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.1.8
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.1.7
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.1.6
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.1.5
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.1.4
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (ionicjs) than the most recent previously approved version (dwieeb) on 2020-08-25, but ionicjs is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v2.1.3
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.1.2
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (dwieeb) than the most recent previously approved version (ionicjs) on 2020-05-06, but dwieeb is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v2.1.1
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (dwieeb) than the most recent previously approved version (ionicjs) on 2020-03-03, but dwieeb is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v2.1.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.0.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.0.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v2.0.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.