@jskit-ai/auth-provider-supabase-core
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| semgrep | semgrep:env-spread | AI (semgrep): env-spread in an auth service provider config builder is a code-quality issue, not malware; stable pattern for this package. | ai |
Versions (showing 51 of 80)
| Version | Deps | Published |
|---|---|---|
| 0.1.85 | 6 / 0 | |
| 0.1.84 | 6 / 0 | |
| 0.1.83 | 6 / 0 | |
| 0.1.82 | 6 / 0 | |
| 0.1.81 | 6 / 0 | |
| 0.1.80 | 6 / 0 | |
| 0.1.79 | 6 / 0 | |
| 0.1.78 | 6 / 0 | |
| 0.1.77 | 6 / 0 | |
| 0.1.76 | 6 / 0 | |
| 0.1.75 | 6 / 0 | |
| 0.1.74 | 6 / 0 | |
| 0.1.73 | 6 / 0 | |
| 0.1.72 | 6 / 0 | |
| 0.1.71 | 6 / 0 | |
| 0.1.70 | 6 / 0 | |
| 0.1.69 | 6 / 0 | |
| 0.1.68 | 6 / 0 | |
| 0.1.67 | 6 / 0 | |
| 0.1.66 | 6 / 0 | |
| 0.1.65 | 6 / 0 | |
| 0.1.64 | 6 / 0 | |
| 0.1.63 | 6 / 0 | |
| 0.1.62 | 6 / 0 | |
| 0.1.61 | 6 / 0 | |
| 0.1.60 | 6 / 0 | |
| 0.1.59 | 6 / 0 | |
| 0.1.58 | 5 / 0 | |
| 0.1.57 | 5 / 0 | |
| 0.1.56 | 5 / 0 | |
| 0.1.55 | 5 / 0 | |
| 0.1.54 | 4 / 0 | |
| 0.1.53 | 4 / 0 | |
| 0.1.52 | 4 / 0 | |
| 0.1.51 | 4 / 0 | |
| 0.1.50 | 4 / 0 | |
| 0.1.49 | 4 / 0 | |
| 0.1.48 | 4 / 0 | |
| 0.1.47 | 4 / 0 | |
| 0.1.46 | 4 / 0 | |
| 0.1.45 | 4 / 0 | |
| 0.1.44 | 4 / 0 | |
| 0.1.43 | 4 / 0 | |
| 0.1.42 | 4 / 0 | |
| 0.1.41 | 4 / 0 | |
| 0.1.40 | 4 / 0 | |
| 0.1.39 | 4 / 0 | |
| 0.1.38 | 4 / 0 | |
| 0.1.37 | 4 / 0 | |
| 0.1.36 | 4 / 0 | |
| 0.1.35 | 4 / 0 |
v0.1.85
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.1.84
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.1.83
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.1.82
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.1.81
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.1.80
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.1.79
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.1.78
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.1.77
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.1.76
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.1.75
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.1.74
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.1.73
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.1.72
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.1.71
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.1.70
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.1.69
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.1.68
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.1.67
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.1.66
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.1.65
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.1.64
2 findingsSpreading entire process.env into an object — may capture all secrets 171 | dependencies?.env && typeof dependencies.env === "object" ? dependencies.env : {}; 172 | > 173 | return { 174 | ...process.env, 175 | ...envFromDependencies
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.1.63
2 findingsSpreading entire process.env into an object — may capture all secrets 171 | dependencies?.env && typeof dependencies.env === "object" ? dependencies.env : {}; 172 | > 173 | return { 174 | ...process.env, 175 | ...envFromDependencies
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.1.62
2 findingsSpreading entire process.env into an object — may capture all secrets 171 | dependencies?.env && typeof dependencies.env === "object" ? dependencies.env : {}; 172 | > 173 | return { 174 | ...process.env, 175 | ...envFromDependencies
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.1.61
2 findingsSpreading entire process.env into an object — may capture all secrets 171 | dependencies?.env && typeof dependencies.env === "object" ? dependencies.env : {}; 172 | > 173 | return { 174 | ...process.env, 175 | ...envFromDependencies
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.1.60
2 findingsSpreading entire process.env into an object — may capture all secrets 171 | dependencies?.env && typeof dependencies.env === "object" ? dependencies.env : {}; 172 | > 173 | return { 174 | ...process.env, 175 | ...envFromDependencies
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.1.59
2 findingsSpreading entire process.env into an object — may capture all secrets 171 | dependencies?.env && typeof dependencies.env === "object" ? dependencies.env : {}; 172 | > 173 | return { 174 | ...process.env, 175 | ...envFromDependencies
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.1.58
2 findingsSpreading entire process.env into an object — may capture all secrets 171 | dependencies?.env && typeof dependencies.env === "object" ? dependencies.env : {}; 172 | > 173 | return { 174 | ...process.env, 175 | ...envFromDependencies
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.1.57
2 findingsSpreading entire process.env into an object — may capture all secrets 171 | dependencies?.env && typeof dependencies.env === "object" ? dependencies.env : {}; 172 | > 173 | return { 174 | ...process.env, 175 | ...envFromDependencies
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.1.56
2 findingsSpreading entire process.env into an object — may capture all secrets 170 | dependencies?.env && typeof dependencies.env === "object" ? dependencies.env : {}; 171 | > 172 | return { 173 | ...process.env, 174 | ...envFromDependencies
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.1.55
2 findingsSpreading entire process.env into an object — may capture all secrets 170 | dependencies?.env && typeof dependencies.env === "object" ? dependencies.env : {}; 171 | > 172 | return { 173 | ...process.env, 174 | ...envFromDependencies
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.1.54
2 findingsSpreading entire process.env into an object — may capture all secrets 170 | dependencies?.env && typeof dependencies.env === "object" ? dependencies.env : {}; 171 | > 172 | return { 173 | ...process.env, 174 | ...envFromDependencies
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.1.53
2 findingsSpreading entire process.env into an object — may capture all secrets 170 | dependencies?.env && typeof dependencies.env === "object" ? dependencies.env : {}; 171 | > 172 | return { 173 | ...process.env, 174 | ...envFromDependencies
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.1.52
2 findingsSpreading entire process.env into an object — may capture all secrets 170 | dependencies?.env && typeof dependencies.env === "object" ? dependencies.env : {}; 171 | > 172 | return { 173 | ...process.env, 174 | ...envFromDependencies
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.1.51
2 findingsSpreading entire process.env into an object — may capture all secrets 169 | dependencies?.env && typeof dependencies.env === "object" ? dependencies.env : {}; 170 | > 171 | return { 172 | ...process.env, 173 | ...envFromDependencies
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.1.50
2 findingsSpreading entire process.env into an object — may capture all secrets 169 | dependencies?.env && typeof dependencies.env === "object" ? dependencies.env : {}; 170 | > 171 | return { 172 | ...process.env, 173 | ...envFromDependencies
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.1.49
2 findingsSpreading entire process.env into an object — may capture all secrets 169 | dependencies?.env && typeof dependencies.env === "object" ? dependencies.env : {}; 170 | > 171 | return { 172 | ...process.env, 173 | ...envFromDependencies
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.1.48
2 findingsSpreading entire process.env into an object — may capture all secrets 169 | dependencies?.env && typeof dependencies.env === "object" ? dependencies.env : {}; 170 | > 171 | return { 172 | ...process.env, 173 | ...envFromDependencies
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.1.47
2 findingsSpreading entire process.env into an object — may capture all secrets 169 | dependencies?.env && typeof dependencies.env === "object" ? dependencies.env : {}; 170 | > 171 | return { 172 | ...process.env, 173 | ...envFromDependencies
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.1.46
2 findingsSpreading entire process.env into an object — may capture all secrets 169 | dependencies?.env && typeof dependencies.env === "object" ? dependencies.env : {}; 170 | > 171 | return { 172 | ...process.env, 173 | ...envFromDependencies
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.1.45
2 findingsSpreading entire process.env into an object — may capture all secrets 167 | const envFromDependencies = 168 | dependencies?.env && typeof dependencies.env === "object" ? dependencies.env : {}; > 169 | const env = { 170 | ...process.env, 171 | ...envFromDependencies
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.1.44
2 findingsSpreading entire process.env into an object — may capture all secrets 167 | const envFromDependencies = 168 | dependencies?.env && typeof dependencies.env === "object" ? dependencies.env : {}; > 169 | const env = { 170 | ...process.env, 171 | ...envFromDependencies
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.1.43
2 findingsSpreading entire process.env into an object — may capture all secrets 167 | const envFromDependencies = 168 | dependencies?.env && typeof dependencies.env === "object" ? dependencies.env : {}; > 169 | const env = { 170 | ...process.env, 171 | ...envFromDependencies
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.1.42
2 findingsSpreading entire process.env into an object — may capture all secrets 167 | const envFromDependencies = 168 | dependencies?.env && typeof dependencies.env === "object" ? dependencies.env : {}; > 169 | const env = { 170 | ...process.env, 171 | ...envFromDependencies
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.1.41
2 findingsSpreading entire process.env into an object — may capture all secrets 167 | const envFromDependencies = 168 | dependencies?.env && typeof dependencies.env === "object" ? dependencies.env : {}; > 169 | const env = { 170 | ...process.env, 171 | ...envFromDependencies
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.1.40
2 findingsSpreading entire process.env into an object — may capture all secrets 167 | const envFromDependencies = 168 | dependencies?.env && typeof dependencies.env === "object" ? dependencies.env : {}; > 169 | const env = { 170 | ...process.env, 171 | ...envFromDependencies
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.1.39
2 findingsSpreading entire process.env into an object — may capture all secrets 167 | const envFromDependencies = 168 | dependencies?.env && typeof dependencies.env === "object" ? dependencies.env : {}; > 169 | const env = { 170 | ...process.env, 171 | ...envFromDependencies
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.1.38
2 findingsSpreading entire process.env into an object — may capture all secrets 167 | const envFromDependencies = 168 | dependencies?.env && typeof dependencies.env === "object" ? dependencies.env : {}; > 169 | const env = { 170 | ...process.env, 171 | ...envFromDependencies
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.1.37
2 findingsSpreading entire process.env into an object — may capture all secrets 167 | const envFromDependencies = 168 | dependencies?.env && typeof dependencies.env === "object" ? dependencies.env : {}; > 169 | const env = { 170 | ...process.env, 171 | ...envFromDependencies
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.1.36
2 findingsSpreading entire process.env into an object — may capture all secrets 167 | const envFromDependencies = 168 | dependencies?.env && typeof dependencies.env === "object" ? dependencies.env : {}; > 169 | const env = { 170 | ...process.env, 171 | ...envFromDependencies
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.1.35
2 findingsSpreading entire process.env into an object — may capture all secrets 167 | const envFromDependencies = 168 | dependencies?.env && typeof dependencies.env === "object" ? dependencies.env : {}; > 169 | const env = { 170 | ...process.env, 171 | ...envFromDependencies
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.