@jjlmoya/utils-finance
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| install-scripts | install-script:postinstall | Benign self-referential postinstall (copies the package's own bundled tool CSS into the consumer public/styles/, node_modules-guarded, no net/exec). Legit @jjlmoya Astro calculator lib; spam-flag is metadata-only (no repo/description) FP. Sibling utils-* already accepted 2026-07-01. | sean | |
| bogus-package | bogus-package | Benign self-referential postinstall (copies the package's own bundled tool CSS into the consumer public/styles/, node_modules-guarded, no net/exec). Legit @jjlmoya Astro calculator lib; spam-flag is metadata-only (no repo/description) FP. Sibling utils-* already accepted 2026-07-01. | sean |
Versions (showing 18 of 18)
| Version | Deps | Published |
|---|---|---|
| 1.20.0 | 9 / 14 | |
| 1.19.0 | 9 / 14 | |
| 1.18.0 | 9 / 14 | |
| 1.17.0 | 9 / 14 | |
| 1.16.0 | 9 / 14 | |
| 1.15.0 | 9 / 14 | |
| 1.14.0 | 9 / 14 | |
| 1.13.0 | 9 / 14 | |
| 1.12.0 | 9 / 14 | |
| 1.11.0 | 9 / 14 | |
| 1.10.0 | 9 / 14 | |
| 1.8.0 | 9 / 14 | |
| 1.7.0 | 9 / 14 | |
| 1.6.0 | 9 / 14 | |
| 1.4.0 | 8 / 14 | |
| 1.3.0 | 8 / 14 | |
| 1.2.0 | 8 / 14 | |
| 1.1.0 | 8 / 14 |
v1.20.0
3 findings[Reject — re-review on republish] (prior reject: AI (install-scripts): Unreviewed postinstall from a brand-new publisher with no repo or description; generalizes until package establishes trust.) Script: node scripts/postinstall.mjs
[Reject — re-review on republish] (prior reject: AI (bogus-package): No repo, no description, no keywords — consistent spam/throwaway indicators for this package.) Matched 4 signal(s), weighted score 6: • [S_KNOWN_SPAM_PUBLISHER] Maintainer(s) previously flagged as spam: jjlmoya. • [S_DESC_MATCHES_NAME] Description is empty or just restates the package name. • [S_NO_REPO_NO_HOME] No repository, homepage, or bugs URL — genuine packages almost always link somewhere. • [S_NO_KEYWORDS] No keywords declared.
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.