← Home

@kodiak-finance/orderly-trading

npm
12
Versions
—
License
No
Install Scripts
Missing
Provenance

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures No source commit

Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.

Maintainers

bearticxsubjectberastotlebards

Keywords

OrderlyUIExchangeDApp

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
dependencies unvetted-dep:@kodiak-finance/orderly-ui-scaffold AI (dependencies): Same-org sibling package pinned to matching version; consistent monorepo pattern across all versions. ai
bogus-package bogus-package AI (bogus-package): Internal monorepo component; no repo/description is consistent across all @kodiak-finance/orderly-* packages in this ecosystem. ai
provenance no-provenance AI (provenance): Consistent across all @kodiak-finance/orderly-* packages; org does not use Sigstore attestation. ai
npm-metadata no-description AI (npm-metadata): Monorepo component package; empty description is a consistent pattern across the org's packages. ai
phantom-deps phantom-dep:@kodiak-finance/orderly-portfolio AI (phantom-deps): Same-org monorepo dep; declared but re-exported rather than directly imported is normal for this package family. ai
phantom-deps phantom-dep:@kodiak-finance/orderly-ui-leverage AI (phantom-deps): Same-org monorepo dep; same rationale as orderly-portfolio. ai

Versions (showing 12 of 12)

Version Deps Published
2.9.2 23 / 9
2.8.32 23 / 9
2.8.30 23 / 9
2.8.29 23 / 9
2.8.25 23 / 9
2.8.22 23 / 9
2.8.15 23 / 9
2.8.10 23 / 9
2.8.9 23 / 9
2.8.6 23 / 9
2.8.3 23 / 9
2.8.0 23 / 9

v2.9.2

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.8.32

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.8.30

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.8.29

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.8.25

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.8.22

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.8.15

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.8.10

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.8.9

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.8.6

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.8.3

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.8.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.