@jsreport/advanced-workers
[](https://npmjs.com/package/@jsreport/advanced-workers)
3
Versions
MIT
License
No
Install Scripts
Missing
Provenance
Supply chain provenance
Status for the latest visible version.
No SLSA provenance
npm registry signatures
gitHead linked
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
pofiderbjrmatos
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| bogus-package | bogus-package | AI (bogus-package): Internal jsreport worker infrastructure; sparse metadata is expected for this type of package. | ai | |
| semgrep | semgrep:dynamic-require | AI (semgrep): Worker handler intentionally loads a configurable module via workerData; this is the core design of an advanced-workers package. | ai | |
| phantom-deps | phantom-dep:uuid | AI (phantom-deps): uuid is a declared dependency used transitively or in files not directly scanned; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:debug | AI (phantom-deps): debug is a declared dependency commonly used via string-based require patterns; stable false positive for this package. | ai |
v2.2.0
1 finding
LOW
No provenance attestation
provenance
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v2.1.0
1 finding
LOW
No provenance attestation
provenance
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.