@jupyterlab/rendermime — Greenflagged

JupyterLab - RenderMime

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures No source commit

Maintainers

darianblink1073jasongroutfcollonvaljtpiombektaskrassowskijupyterlab-release-bot

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
phantom-deps	phantom-dep:@phosphor/algorithm	AI (phantom-deps): Phosphor framework package referenced in config files; standard JupyterLab dependency pattern.	ai	2026/04/24
phantom-deps	phantom-dep:@phosphor/disposable	AI (phantom-deps): Phosphor framework package referenced in config files; standard JupyterLab dependency pattern.	ai	2026/04/24
provenance	no-provenance	AI (provenance): Long-established JupyterLab monorepo package predating Sigstore provenance adoption on npm; no provenance is expected for this era of publishing.	ai	2026/04/24
dependencies	unvetted-dep:ansi_up	AI (dependencies): ansi_up is a legitimate, widely-used ANSI escape code parser; its use in JupyterLab rendermime is expected and appropriate.	ai	2026/04/24
phantom-deps	phantom-dep:@types/marked	AI (phantom-deps): @types/marked is a TypeScript type declaration package; declaring it as a dependency without direct imports is standard TypeScript practice for this package.	ai	2026/04/24
phantom-deps	phantom-dep:@types/mathjax	AI (phantom-deps): @types/mathjax is a TypeScript type declaration package; declaring it as a dependency without direct imports is standard TypeScript practice for this package.	ai	2026/04/24
dependencies	unvetted-dep:@jupyterlab/apputils	AI (dependencies): Official JupyterLab monorepo sub-package; no security concerns.	ai	2026/04/21
dependencies	unvetted-dep:@jupyterlab/nbformat	AI (dependencies): Official JupyterLab monorepo sub-package; no security concerns.	ai	2026/04/21
dependencies	unvetted-dep:@jupyterlab/services	AI (dependencies): Official JupyterLab monorepo sub-package; no security concerns.	ai	2026/04/21
bogus-package	bogus-package	AI (bogus-package): Monorepo sub-package of JupyterLab; inflated semver, short README, and no keywords are expected for automated monorepo releases. SLSA provenance confirms legitimacy.	ai	2026/04/21
dependencies	unvetted-dep:@jupyterlab/observables	AI (dependencies): Official JupyterLab monorepo sub-package; no security concerns.	ai	2026/04/21
dependencies	unvetted-dep:@jupyterlab/translation	AI (dependencies): Official JupyterLab monorepo sub-package; no security concerns.	ai	2026/04/21
dependencies	unvetted-dep:@jupyterlab/rendermime-interfaces	AI (dependencies): Official JupyterLab monorepo sub-package; no security concerns.	ai	2026/04/21
dependencies	unvetted-dep:@jupyterlab/coreutils	AI (dependencies): Official JupyterLab monorepo sub-package; no security concerns.	ai	2026/04/21
dependencies	unvetted-dep:lodash.escape	AI (dependencies): lodash.escape is a well-known, widely-used utility package with no security concerns relevant to this context.	ai	2026/04/21
dependencies	unvetted-dep:@lumino/widgets	AI (dependencies): Canonical Lumino UI framework package maintained by Project Jupyter; no security concerns.	ai	2026/04/21
dependencies	unvetted-dep:@lumino/coreutils	AI (dependencies): Canonical Lumino package maintained by Project Jupyter; no security concerns.	ai	2026/04/21
dependencies	unvetted-dep:@lumino/messaging	AI (dependencies): Canonical Lumino package maintained by Project Jupyter; no security concerns.	ai	2026/04/21
dependencies	unvetted-dep:@lumino/signaling	AI (dependencies): Canonical Lumino package maintained by Project Jupyter; no security concerns.	ai	2026/04/21

Versions (showing 99 of 199)

Version	Deps	Published
3.1.12	15 / 11	2021-09-22
3.1.11	15 / 11	2021-09-14
3.1.10	15 / 11	2021-09-08
3.1.9	15 / 11	2021-09-01
3.1.8	15 / 11	2021-08-25
3.1.7	15 / 11	2021-08-24
3.1.6	15 / 11	2021-08-16
3.1.5	15 / 11	2021-08-12
3.1.4	15 / 11	2021-08-09
3.1.3	15 / 11	2021-08-05
3.1.2	15 / 11	2021-08-05
3.1.1	15 / 11	2021-08-04
3.1.0	15 / 11	2021-07-27
3.0.12	15 / 11	2021-09-28
3.0.11	15 / 11	2021-08-05
3.0.10	15 / 11	2021-05-18
3.0.9	15 / 11	2021-05-10
3.0.8	15 / 11	2021-04-12
3.0.7	15 / 11	2021-04-08
3.0.6	15 / 11	2021-02-22
3.0.5	15 / 11	2021-02-17
3.0.4	15 / 11	2021-01-28
3.0.3	15 / 11	2021-01-14
3.0.2	15 / 11	2021-01-09
3.0.1	15 / 11	2021-01-08
3.0.0	15 / 11	2020-12-24
2.3.1	14 / 11	2021-08-05
2.3.0	14 / 11	2021-03-19
2.2.4	14 / 11	2020-10-23
2.2.3	14 / 11	2020-09-14
2.2.2	14 / 11	2020-08-24
2.2.1	14 / 11	2020-08-07
2.2.0	14 / 11	2020-07-15
2.1.1	14 / 5	2020-05-04
2.1.0	14 / 5	2020-04-06
2.0.3	14 / 5	2020-04-06
2.0.2	14 / 5	2020-03-06
2.0.1	14 / 5	2020-03-06
2.0.0	14 / 5	2020-02-28
1.2.11	13 / 5	2021-08-05
1.2.10	13 / 5	2021-03-15
1.2.9	13 / 5	2020-09-14
1.2.8	13 / 5	2020-05-08
1.2.7	13 / 5	2020-04-28
1.2.6	13 / 5	2020-04-27
1.2.5	13 / 5	2020-04-24
1.2.4	13 / 5	2020-04-13
1.2.3	13 / 5	2020-04-09
1.2.2	13 / 5	2020-03-29
1.2.1	13 / 5	2019-11-12
1.2.0	13 / 5	2019-10-29
1.1.3	13 / 5	2019-09-18
1.1.2	13 / 5	2019-09-10
1.1.1	13 / 5	2019-09-07
1.1.0	13 / 5	2019-08-28
1.0.5	13 / 5	2019-08-21
1.0.4	13 / 5	2019-08-16
1.0.3	13 / 5	2019-08-09
1.0.2	13 / 5	2019-07-25
1.0.1	13 / 5	2019-07-09
1.0.0	13 / 5	2019-06-28
0.19.1	13 / 4	2018-10-05
0.18.4	13 / 3	2018-08-24
0.18.3	13 / 3	2018-08-21
0.18.2	13 / 3	2018-08-18
0.18.0	13 / 3	2018-08-16
0.17.3	13 / 3	2018-07-28
0.17.2	13 / 3	2018-07-27
0.17.1	13 / 3	2018-07-25
0.16.3	12 / 3	2018-04-28
0.16.2	12 / 3	2018-04-16
0.16.1	12 / 3	2018-04-14
0.16.0	12 / 3	2018-04-11
0.15.4	12 / 3	2018-02-06
0.15.3	12 / 3	2018-02-05
0.15.2	12 / 3	2018-01-25
0.15.1	12 / 3	2018-01-13
0.15.0	12 / 3	2018-01-10
0.14.1	12 / 3	2017-12-23
0.14.0	12 / 3	2017-12-23
0.13.0	12 / 4	2017-12-02
0.12.0	11 / 4	2017-11-09
0.11.1	11 / 4	2017-10-13
0.11.0	11 / 4	2017-10-12
0.10.0	11 / 4	2017-08-23
0.9.0	13 / 2	2017-07-21
0.8.2	13 / 2	2017-07-11
0.8.1	13 / 2	2017-07-07
0.8.0	13 / 2	2017-07-07
0.7.0	12 / 2	2017-06-16
0.6.0	12 / 2	2017-06-01
0.5.0	12 / 2	2017-05-18
0.4.0	12 / 2	2017-05-09
0.3.2	12 / 2	2017-04-25
0.3.1	12 / 2	2017-04-21
0.3.0	12 / 2	2017-04-21
0.2.0	12 / 2	2017-04-04
0.1.4	12 / 2	2017-03-24
0.1.3	12 / 2	2017-03-21

v3.1.12

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v3.1.11

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v3.1.10

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v3.1.9

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v3.1.8

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v3.1.7

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v3.1.6

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v3.1.5

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v3.1.4

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v3.1.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v3.1.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v3.1.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v3.1.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v3.0.12

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v3.0.11

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v3.0.10

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v3.0.9

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v3.0.8

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v3.0.7

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v3.0.6

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v3.0.5

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v3.0.4

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v3.0.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v3.0.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v3.0.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v3.0.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.3.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.3.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.2.4

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.2.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.2.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.2.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.2.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.1.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.1.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.0.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.0.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.0.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.0.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.2.11

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.2.10

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.2.9

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.2.8

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.2.7

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.2.6

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.2.5

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.2.4

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.2.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.2.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.2.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.2.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.1.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.1.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.1.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.1.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.0.5

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.0.4

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.0.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.0.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.0.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.0.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.19.1

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.18.4

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.18.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.18.2

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.18.0

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.17.3

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.17.2

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.17.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.16.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.16.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.16.1

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.16.0

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.15.4

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.15.3

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.15.2

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.15.1

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.15.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.14.1

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.14.0

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.13.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.12.0

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.11.1

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.11.0

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.10.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.9.0

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.8.2

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.8.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.8.0

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.7.0

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.6.0

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.5.0

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.4.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.3.2

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.3.1

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.3.0

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.2.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.1.4

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.1.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.