@knapsack/rollup-config-starter
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| provenance | no-provenance | AI (provenance): Provenance attestation is a best-practice signal, not a security blocker for established packages. | ai | |
| dependencies | unvetted-dep:rollup-plugin-sass | AI (dependencies): Standard rollup SASS plugin; expected in a rollup config starter. | ai | |
| dependencies | unvetted-dep:node-sass-magic-importer | AI (dependencies): Known SASS importer utility; appropriate for this package's purpose. | ai | |
| dependencies | unvetted-dep:rollup-plugin-polyfill-node | AI (dependencies): Standard rollup node polyfill plugin; expected in a rollup config starter. | ai | |
| dependencies | unvetted-dep:svgo | AI (dependencies): svgo is a well-known SVG optimizer; legitimate dependency for a rollup config package. | ai | |
| phantom-deps | phantom-dep:tslib | AI (phantom-deps): tslib is a known implicit TypeScript runtime dep; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:@rollup/plugin-babel | AI (phantom-deps): Framework-scoped plugin loaded by convention in rollup config; stable false positive. | ai | |
| phantom-deps | phantom-dep:rollup-plugin-polyfill-node | AI (phantom-deps): Referenced in config files but not directly imported; stable false positive for this rollup config package. | ai | |
| npm-metadata | no-description | AI (npm-metadata): Intentionally empty description for internal config package; stable pattern across 8484 versions. | ai | |
| bogus-package | bogus-package | AI (bogus-package): Internal monorepo tooling package; sparse README/description is expected for org-internal config starters. | ai |
Versions (showing 100 of 197)
| Version | Deps | Published |
|---|---|---|
| 5.0.0 | 19 / 4 | |
| 4.97.0 | 19 / 4 | |
| 4.96.7 | 19 / 4 | |
| 4.96.6 | 19 / 4 | |
| 4.96.5 | 19 / 4 | |
| 4.96.4 | 19 / 4 | |
| 4.96.3 | 19 / 4 | |
| 4.96.2 | 19 / 4 | |
| 4.96.1 | 19 / 4 | |
| 4.96.0 | 19 / 4 | |
| 4.95.1 | 19 / 4 | |
| 4.95.0 | 19 / 4 | |
| 4.94.13 | 19 / 4 | |
| 4.94.12 | 19 / 4 | |
| 4.94.11 | 19 / 4 | |
| 4.94.10 | 19 / 4 | |
| 4.94.9 | 19 / 4 | |
| 4.94.8 | 19 / 4 | |
| 4.94.7 | 19 / 4 | |
| 4.94.6 | 19 / 4 | |
| 4.94.5 | 19 / 4 | |
| 4.94.4 | 19 / 4 | |
| 4.94.3 | 19 / 4 | |
| 4.94.2 | 19 / 4 | |
| 4.94.1 | 19 / 4 | |
| 4.94.0 | 19 / 4 | |
| 4.93.3 | 19 / 4 | |
| 4.93.2 | 19 / 4 | |
| 4.93.1 | 19 / 4 | |
| 4.93.0 | 19 / 4 | |
| 4.92.24 | 19 / 4 | |
| 4.92.23 | 19 / 4 | |
| 4.92.22 | 19 / 4 | |
| 4.92.21 | 19 / 4 | |
| 4.92.20 | 19 / 4 | |
| 4.92.18 | 19 / 4 | |
| 4.92.17 | 19 / 4 | |
| 4.92.15 | 19 / 4 | |
| 4.92.13 | 19 / 4 | |
| 4.92.11 | 19 / 4 | |
| 4.92.10 | 19 / 4 | |
| 4.92.9 | 19 / 4 | |
| 4.92.8 | 19 / 4 | |
| 4.92.7 | 19 / 4 | |
| 4.92.6 | 19 / 4 | |
| 4.92.4 | 19 / 4 | |
| 4.92.3 | 19 / 4 | |
| 4.79.1 | 19 / 4 | |
| 4.78.14 | 19 / 4 | |
| 4.78.13 | 19 / 4 | |
| 4.78.12 | 19 / 4 | |
| 4.78.11 | 19 / 4 | |
| 4.78.10 | 19 / 4 | |
| 4.78.9 | 19 / 4 | |
| 4.78.8 | 19 / 4 | |
| 4.78.7 | 19 / 4 | |
| 4.78.6 | 19 / 4 | |
| 4.78.5 | 19 / 4 | |
| 4.78.4 | 19 / 4 | |
| 4.78.3 | 19 / 4 | |
| 4.78.2 | 19 / 4 | |
| 4.78.1 | 19 / 4 | |
| 4.78.0 | 19 / 4 | |
| 4.77.0 | 19 / 4 | |
| 4.76.3 | 19 / 4 | |
| 4.76.2 | 19 / 4 | |
| 4.76.1 | 19 / 4 | |
| 4.76.0 | 19 / 4 | |
| 4.75.9 | 19 / 4 | |
| 4.75.8 | 19 / 4 | |
| 4.75.7 | 19 / 4 | |
| 4.75.6 | 19 / 4 | |
| 4.75.5 | 19 / 4 | |
| 4.75.4 | 19 / 4 | |
| 4.75.3 | 19 / 4 | |
| 4.75.2 | 19 / 4 | |
| 4.75.1 | 19 / 4 | |
| 4.75.0 | 19 / 4 | |
| 4.74.0 | 19 / 4 | |
| 4.73.0 | 19 / 4 | |
| 4.72.1 | 19 / 4 | |
| 4.72.0 | 19 / 4 | |
| 4.71.18 | 19 / 4 | |
| 4.71.17 | 19 / 4 | |
| 4.71.16 | 19 / 4 | |
| 4.71.15 | 19 / 4 | |
| 4.71.14 | 19 / 4 | |
| 4.71.13 | 19 / 4 | |
| 4.71.12 | 19 / 4 | |
| 4.71.11 | 19 / 4 | |
| 4.71.10 | 19 / 4 | |
| 4.71.9 | 19 / 4 | |
| 4.71.8 | 19 / 4 | |
| 4.71.7 | 19 / 4 | |
| 4.71.6 | 19 / 4 | |
| 4.71.5 | 19 / 4 | |
| 4.71.4 | 19 / 4 | |
| 4.71.3 | 19 / 4 | |
| 4.71.2 | 19 / 4 | |
| 4.71.1 | 19 / 4 |
v4.97.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.96.7
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.96.6
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.96.5
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.96.4
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.96.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.96.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.96.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.96.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.95.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.95.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.94.13
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.94.12
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.94.11
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.94.10
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.79.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.78.14
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.78.13
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.78.12
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.78.11
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.78.10
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.78.9
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.78.8
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.78.7
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.78.6
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.78.5
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.78.4
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.78.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.78.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.78.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.78.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.77.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.76.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.76.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.76.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.76.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.75.9
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.75.8
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.75.7
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.75.6
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.75.5
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.75.4
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.75.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.75.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.75.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.75.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.74.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.73.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.72.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.72.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.71.18
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.71.17
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.71.16
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.71.15
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.71.14
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.71.13
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.71.12
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.71.11
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.71.10
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.71.9
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.71.8
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.71.7
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.71.6
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.71.5
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.71.4
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.71.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.71.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.71.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.