← Home

@letsrunit/mcp-server

npm Repository Homepage

MCP server for letsrunit — AI-agent browser test generation and execution

55
Versions
MIT
License
No
Install Scripts
Verified
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures gitHead linked

Maintainers

jasny

Keywords

testingautomationmcpplaywrightletsrunit

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
source-diff encoded-string-file:dist/index.js AI (source-diff): Encoded string is llhttp WASM binary from cheerio/undici — standard bundled WebAssembly, not a malicious payload. ai
source-diff source-size-tripled AI (source-diff): Size increase explained by bundling llhttp WASM blob and @cucumber/cucumber; consistent with legitimate dependency addition. ai
publish-pattern new-deps-added AI (publish-pattern): @cucumber/cucumber is an established, well-known test framework; addition is consistent with package purpose. ai
semgrep semgrep:env-spread AI (semgrep): Spreading process.env into spawnSync to pass environment to child process; standard bootstrap pattern, not exfiltration. ai
phantom-deps phantom-dep:@playwright/test AI (phantom-deps): Referenced in config files as documented; not a direct import concern. ai
semgrep semgrep:env-bulk-read AI (semgrep): Explicitly filters to LETSRUNIT_* keys only; not a broad secret enumeration. ai
phantom-deps phantom-dep:@letsrunit/utils AI (phantom-deps): Same org scope; likely used transitively within the monorepo. ai

Versions (showing 55 of 55)

Version Deps Published
0.23.3 11 / 2
0.23.2 11 / 2
0.23.1 11 / 2
0.23.0 11 / 2
0.22.0 11 / 2
0.21.1 11 / 2
0.21.0 11 / 2
0.20.0 11 / 2
0.19.5 11 / 2
0.19.4 11 / 2
0.19.3 11 / 2
0.19.2 11 / 2
0.19.1 11 / 2
0.19.0 11 / 2
0.18.3 11 / 2
0.18.2 11 / 2
0.18.1 11 / 2
0.18.0 11 / 2
0.17.1 11 / 2
0.17.0 11 / 2
0.16.0 11 / 2
0.15.1 11 / 2
0.15.0 11 / 2
0.14.5 11 / 2
0.14.4 11 / 2
0.14.3 11 / 2
0.14.2 11 / 2
0.14.1 11 / 2
0.14.0 11 / 2
0.13.3 11 / 2
0.13.2 10 / 2
0.13.1 10 / 2
0.13.0 10 / 2
0.12.0 10 / 2
0.11.0 10 / 2
0.9.1 9 / 2
0.9.0 9 / 2
0.8.0 9 / 2
0.7.1 7 / 2
0.7.0 7 / 4
0.6.0 7 / 4
0.5.1 7 / 4
0.5.0 7 / 4
0.4.2 7 / 4
0.4.1 7 / 4
0.4.0 7 / 4
0.3.10 7 / 4
0.3.9 7 / 4
0.3.8 7 / 4
0.3.7 7 / 4
0.3.6 7 / 4
0.3.4 7 / 4
0.3.3 7 / 4
0.3.0 7 / 4
0.2.6 7 / 4

v0.23.3

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.23.2

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.23.1

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.23.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.22.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.21.1

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.21.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.20.0

2 findings
HIGH env-spread: src/bootstrap.ts:77 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/letsrunit-hq/letsrunit/blob/930c90d97b8e29f5dbdcef6466647bdca48c97a6/src/bootstrap.ts#L77 75 | const result = spawnSync(process.execPath, [projectEntrypointPath, ...process.argv.slice(2)], { 76 | stdio: 'inherit', > 77 | env: { 78 | ...process.env, 79 | LETSRUNIT_MCP_RUNTIME_MODE: 'project',

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.19.5

2 findings
HIGH env-spread: src/bootstrap.ts:77 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/letsrunit-hq/letsrunit/blob/f6d1f6cb795111c76cee059ca0e12f302d846bb1/src/bootstrap.ts#L77 75 | const result = spawnSync(process.execPath, [projectEntrypointPath, ...process.argv.slice(2)], { 76 | stdio: 'inherit', > 77 | env: { 78 | ...process.env, 79 | LETSRUNIT_MCP_RUNTIME_MODE: 'project',

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.19.4

2 findings
HIGH env-spread: src/bootstrap.ts:77 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/letsrunit-hq/letsrunit/blob/bdc1868c0dddf7d6ef8cf2b43ed78c541392b4e6/src/bootstrap.ts#L77 75 | const result = spawnSync(process.execPath, [projectEntrypointPath, ...process.argv.slice(2)], { 76 | stdio: 'inherit', > 77 | env: { 78 | ...process.env, 79 | LETSRUNIT_MCP_RUNTIME_MODE: 'project',

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.19.3

2 findings
HIGH env-spread: src/bootstrap.ts:77 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/letsrunit-hq/letsrunit/blob/15db2bc1f3efb940adc45a6dbfc69f2673a49b8c/src/bootstrap.ts#L77 75 | const result = spawnSync(process.execPath, [projectEntrypointPath, ...process.argv.slice(2)], { 76 | stdio: 'inherit', > 77 | env: { 78 | ...process.env, 79 | LETSRUNIT_MCP_RUNTIME_MODE: 'project',

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.19.2

2 findings
HIGH env-spread: src/bootstrap.ts:77 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/letsrunit-hq/letsrunit/blob/338573a92138c12464defe2ef30f2dd47dcf41e0/src/bootstrap.ts#L77 75 | const result = spawnSync(process.execPath, [projectEntrypointPath, ...process.argv.slice(2)], { 76 | stdio: 'inherit', > 77 | env: { 78 | ...process.env, 79 | LETSRUNIT_MCP_RUNTIME_MODE: 'project',

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.19.1

2 findings
HIGH env-spread: src/bootstrap.ts:77 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/letsrunit-hq/letsrunit/blob/784da40c476457cc6136f277abd009bbe834d63e/src/bootstrap.ts#L77 75 | const result = spawnSync(process.execPath, [projectEntrypointPath, ...process.argv.slice(2)], { 76 | stdio: 'inherit', > 77 | env: { 78 | ...process.env, 79 | LETSRUNIT_MCP_RUNTIME_MODE: 'project',

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.19.0

2 findings
HIGH env-spread: src/bootstrap.ts:77 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/letsrunit-hq/letsrunit/blob/a2b6e4eff1fafef797c504061bc1d483f4479ef9/src/bootstrap.ts#L77 75 | const result = spawnSync(process.execPath, [projectEntrypointPath, ...process.argv.slice(2)], { 76 | stdio: 'inherit', > 77 | env: { 78 | ...process.env, 79 | LETSRUNIT_MCP_RUNTIME_MODE: 'project',

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.18.3

2 findings
HIGH env-spread: src/bootstrap.ts:77 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/letsrunit-hq/letsrunit/blob/cf9591c1ae4931aab0774b88c4d69d1cd80f7ce1/src/bootstrap.ts#L77 75 | const result = spawnSync(process.execPath, [projectEntrypointPath, ...process.argv.slice(2)], { 76 | stdio: 'inherit', > 77 | env: { 78 | ...process.env, 79 | LETSRUNIT_MCP_RUNTIME_MODE: 'project',

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.18.2

2 findings
HIGH env-spread: src/bootstrap.ts:77 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/letsrunit-hq/letsrunit/blob/de8cd527a54d5d93515443d100dbea708e004a35/src/bootstrap.ts#L77 75 | const result = spawnSync(process.execPath, [projectEntrypointPath, ...process.argv.slice(2)], { 76 | stdio: 'inherit', > 77 | env: { 78 | ...process.env, 79 | LETSRUNIT_MCP_RUNTIME_MODE: 'project',

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.18.1

2 findings
HIGH env-spread: src/bootstrap.ts:77 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/letsrunit-hq/letsrunit/blob/4aae3e6d70ca4eb14516dc47dac04fa2bc279cf6/src/bootstrap.ts#L77 75 | const result = spawnSync(process.execPath, [projectEntrypointPath, ...process.argv.slice(2)], { 76 | stdio: 'inherit', > 77 | env: { 78 | ...process.env, 79 | LETSRUNIT_MCP_RUNTIME_MODE: 'project',

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.18.0

2 findings
HIGH env-spread: src/bootstrap.ts:77 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/letsrunit-hq/letsrunit/blob/869366a3a335bbfb4c49ac4f18605b3e400c7c27/src/bootstrap.ts#L77 75 | const result = spawnSync(process.execPath, [projectEntrypointPath, ...process.argv.slice(2)], { 76 | stdio: 'inherit', > 77 | env: { 78 | ...process.env, 79 | LETSRUNIT_MCP_RUNTIME_MODE: 'project',

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.17.1

2 findings
HIGH env-spread: src/bootstrap.ts:77 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/letsrunit-hq/letsrunit/blob/420058e2603a9c7abd1298dbc2915b2c6a788198/src/bootstrap.ts#L77 75 | const result = spawnSync(process.execPath, [projectEntrypointPath, ...process.argv.slice(2)], { 76 | stdio: 'inherit', > 77 | env: { 78 | ...process.env, 79 | LETSRUNIT_MCP_RUNTIME_MODE: 'project',

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.17.0

2 findings
HIGH env-spread: src/bootstrap.ts:77 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/letsrunit-hq/letsrunit/blob/a10f14383f45c6490d75026a1c1328241c5efbdc/src/bootstrap.ts#L77 75 | const result = spawnSync(process.execPath, [projectEntrypointPath, ...process.argv.slice(2)], { 76 | stdio: 'inherit', > 77 | env: { 78 | ...process.env, 79 | LETSRUNIT_MCP_RUNTIME_MODE: 'project',

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.16.0

2 findings
HIGH env-spread: src/bootstrap.ts:77 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/letsrunit-hq/letsrunit/blob/d288ee69f512f8108956f60997a91b8ca86d24f4/src/bootstrap.ts#L77 75 | const result = spawnSync(process.execPath, [projectEntrypointPath, ...process.argv.slice(2)], { 76 | stdio: 'inherit', > 77 | env: { 78 | ...process.env, 79 | LETSRUNIT_MCP_RUNTIME_MODE: 'project',

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.15.1

2 findings
HIGH env-spread: src/bootstrap.ts:77 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/letsrunit-hq/letsrunit/blob/7256622ab92672df06e0481d1ec4936a1694d65d/src/bootstrap.ts#L77 75 | const result = spawnSync(process.execPath, [projectEntrypointPath, ...process.argv.slice(2)], { 76 | stdio: 'inherit', > 77 | env: { 78 | ...process.env, 79 | LETSRUNIT_MCP_RUNTIME_MODE: 'project',

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.15.0

2 findings
HIGH env-spread: src/bootstrap.ts:77 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/letsrunit-hq/letsrunit/blob/424540185eaaea9fbfdf2ba916fee82d91f3f007/src/bootstrap.ts#L77 75 | const result = spawnSync(process.execPath, [projectEntrypointPath, ...process.argv.slice(2)], { 76 | stdio: 'inherit', > 77 | env: { 78 | ...process.env, 79 | LETSRUNIT_MCP_RUNTIME_MODE: 'project',

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.14.5

2 findings
HIGH env-spread: src/bootstrap.ts:77 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/letsrunit-hq/letsrunit/blob/dfd631996c6c3d1e7c0371942c1a2085ffa42b21/src/bootstrap.ts#L77 75 | const result = spawnSync(process.execPath, [projectEntrypointPath, ...process.argv.slice(2)], { 76 | stdio: 'inherit', > 77 | env: { 78 | ...process.env, 79 | LETSRUNIT_MCP_RUNTIME_MODE: 'project',

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.14.4

2 findings
HIGH env-spread: src/bootstrap.ts:64 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/letsrunit-hq/letsrunit/blob/59c45267790b91f12e489d4e755401e03af12803/src/bootstrap.ts#L64 62 | const result = spawnSync(process.execPath, [projectEntrypointPath, ...process.argv.slice(2)], { 63 | stdio: 'inherit', > 64 | env: { 65 | ...process.env, 66 | LETSRUNIT_MCP_BOOTSTRAPPED: '1',

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.14.3

2 findings
HIGH env-spread: src/bootstrap.ts:64 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/letsrunit-hq/letsrunit/blob/5203c5a74fa88823c8c836033a5b4bfd5185fd0f/src/bootstrap.ts#L64 62 | const result = spawnSync(process.execPath, [projectEntrypointPath, ...process.argv.slice(2)], { 63 | stdio: 'inherit', > 64 | env: { 65 | ...process.env, 66 | LETSRUNIT_MCP_BOOTSTRAPPED: '1',

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.14.2

2 findings
HIGH env-spread: src/bootstrap.ts:101 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/letsrunit-hq/letsrunit/blob/c3acda6cf25b574474b982459967f2ecac700fb4/src/bootstrap.ts#L101 99 | const result = spawnSync(process.execPath, [entry, ...process.argv.slice(2)], { 100 | stdio: 'inherit', > 101 | env: { 102 | ...process.env, 103 | LETSRUNIT_MCP_BOOTSTRAPPED: '1',

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.14.1

2 findings
HIGH env-spread: src/bootstrap.ts:88 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/letsrunit-hq/letsrunit/blob/eea481346c1f9d4c834c0093e7c3da85a08ccfe0/src/bootstrap.ts#L88 86 | const result = spawnSync(process.execPath, [entry, ...process.argv.slice(2)], { 87 | stdio: 'inherit', > 88 | env: { 89 | ...process.env, 90 | LETSRUNIT_MCP_BOOTSTRAPPED: '1',

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.14.0

2 findings
HIGH env-spread: src/bootstrap.ts:88 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/letsrunit-hq/letsrunit/blob/ba3a7c75cc353a11d1ab59a6dcbae8ad82b8117f/src/bootstrap.ts#L88 86 | const result = spawnSync(process.execPath, [entry, ...process.argv.slice(2)], { 87 | stdio: 'inherit', > 88 | env: { 89 | ...process.env, 90 | LETSRUNIT_MCP_BOOTSTRAPPED: '1',

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.13.3

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.13.2

2 findings
HIGH Long encoded string in modified file: dist/index.js source-diff

Modified file contains 2 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.13.1

2 findings
HIGH Long encoded string in modified file: dist/index.js source-diff

Modified file contains 2 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.13.0

2 findings
HIGH Long encoded string in modified file: dist/index.js source-diff

Modified file contains 2 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.12.0

2 findings
HIGH Long encoded string in modified file: dist/index.js source-diff

Modified file contains 2 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.11.0

2 findings
HIGH Long encoded string in modified file: dist/index.js source-diff

Modified file contains 2 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.9.1

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.9.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.8.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.7.1

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.7.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.6.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.5.1

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.5.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.4.2

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.4.1

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.4.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.3.10

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.3.9

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.3.8

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.3.7

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.3.6

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.3.4

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.3.3

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.3.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.2.6

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.