@ldn-viz/maps
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| npm-metadata | no-description | AI (npm-metadata): Scoped org package; missing description is a style issue, not a malware signal for this established package. | ai | |
| dependencies | unvetted-dep:terra-draw | AI (dependencies): terra-draw is a legitimate open-source drawing library for maps; no malware indicators. | ai | |
| dependencies | unvetted-dep:@ldn-viz/utils | AI (dependencies): Same org scope (@ldn-viz); internal utility package, stable false positive. | ai | |
| phantom-deps | phantom-dep:@deck.gl/layers | AI (phantom-deps): deck.gl layers used in config/re-exports; stable false positive for this mapping library. | ai | |
| phantom-deps | phantom-dep:@deck.gl/mapbox | AI (phantom-deps): Same pattern as other deck.gl phantom deps. | ai | |
| phantom-deps | phantom-dep:@deck.gl/geo-layers | AI (phantom-deps): Same pattern as other deck.gl phantom deps. | ai | |
| typosquat | typosquat.levenshtein:hapi | AI (typosquat): Scoped @ldn-viz/maps package; Levenshtein match to 'hapi' is a false positive with no semantic similarity. | ai | |
| phantom-deps | phantom-dep:terra-draw-maplibre-gl-adapter | AI (phantom-deps): Terra-draw adapter referenced in config; stable false positive for this mapping library. | ai | |
| phantom-deps | phantom-dep:@ldn-viz/utils | AI (phantom-deps): Same-org utility package; used in config/re-exports, stable false positive. | ai | |
| phantom-deps | phantom-dep:svelte-floating-ui | AI (phantom-deps): Svelte UI utility used in component config; stable false positive. | ai | |
| phantom-deps | phantom-dep:@turf/turf | AI (phantom-deps): Geo library used in config/re-exports in Svelte component packages; stable false positive. | ai | |
| phantom-deps | phantom-dep:@turf/centroid | AI (phantom-deps): Same as @turf/turf — config/re-export pattern in Svelte library. | ai |
Versions (showing 5 of 5)
| Version | Deps | Published |
|---|---|---|
| 13.0.0 | 12 / 28 | |
| 12.0.0 | 12 / 28 | |
| 11.0.0 | 12 / 28 | |
| 10.0.0 | 12 / 28 | |
| 9.0.0 | 12 / 28 |
v13.0.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v12.0.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v11.0.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v10.0.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.0.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.