@jjlmoya/utils-home
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| install-scripts | install-script:postinstall | Benign self-referential postinstall (copies the package's own bundled tool CSS into the consumer public/styles/, node_modules-guarded, no net/exec). Legit @jjlmoya Astro calculator lib; spam-flag is metadata-only (no repo/description) FP. Sibling utils-* already accepted 2026-07-01. | sean | |
| bogus-package | bogus-package | Benign self-referential postinstall (copies the package's own bundled tool CSS into the consumer public/styles/, node_modules-guarded, no net/exec). Legit @jjlmoya Astro calculator lib; spam-flag is metadata-only (no repo/description) FP. Sibling utils-* already accepted 2026-07-01. | sean |
Versions (showing 31 of 31)
| Version | Deps | Published |
|---|---|---|
| 1.37.0 | 7 / 15 | |
| 1.36.0 | 7 / 15 | |
| 1.35.0 | 7 / 15 | |
| 1.34.0 | 7 / 15 | |
| 1.33.0 | 7 / 15 | |
| 1.32.0 | 7 / 15 | |
| 1.31.0 | 6 / 15 | |
| 1.30.0 | 6 / 15 | |
| 1.29.0 | 6 / 15 | |
| 1.28.0 | 6 / 15 | |
| 1.27.0 | 6 / 15 | |
| 1.26.0 | 6 / 15 | |
| 1.25.0 | 6 / 15 | |
| 1.24.0 | 6 / 15 | |
| 1.23.0 | 6 / 15 | |
| 1.17.0 | 6 / 15 | |
| 1.16.0 | 6 / 15 | |
| 1.15.0 | 6 / 15 | |
| 1.14.0 | 6 / 15 | |
| 1.13.0 | 6 / 15 | |
| 1.12.0 | 6 / 15 | |
| 1.10.0 | 6 / 15 | |
| 1.9.0 | 6 / 15 | |
| 1.8.0 | 6 / 15 | |
| 1.7.0 | 6 / 15 | |
| 1.6.0 | 5 / 15 | |
| 1.5.0 | 5 / 15 | |
| 1.4.0 | 5 / 15 | |
| 1.3.0 | 5 / 15 | |
| 1.2.0 | 5 / 15 | |
| 1.1.0 | 5 / 15 |
v1.37.0
3 findings[Reject — re-review on republish] (prior reject: AI (install-scripts): Publisher has 2 prior rejections, no repo, and postinstall runs opaque script — pattern generalizes across versions.) Script: node scripts/postinstall.mjs
[Reject — re-review on republish] (prior reject: AI (bogus-package): No description, no repo, no keywords — spam/throwaway indicators stable for this package.) Matched 4 signal(s), weighted score 6: • [S_KNOWN_SPAM_PUBLISHER] Maintainer(s) previously flagged as spam: jjlmoya. • [S_DESC_MATCHES_NAME] Description is empty or just restates the package name. • [S_NO_REPO_NO_HOME] No repository, homepage, or bugs URL — genuine packages almost always link somewhere. • [S_NO_KEYWORDS] No keywords declared.
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.