@lhci/utils Apache-2.0 41 versions

@lhci/utils

npm Repository Homepage

[![npm version](https://badge.fury.io/js/%40lhci%2Futils.svg)](https://badge.fury.io/js/%40lhci%2Futils)

41

Versions

Apache-2.0

License

No

Install Scripts

Missing

Provenance

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.

Maintainers

paulirishpatrickhulcehotenadamraine

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
provenance	publisher-changed-stale	AI (provenance): Long-stale publisher change with no takedown; consistent with legitimate maintainer transfer.	ai	2026/07/24
maintainer-change	maintainer-added	AI (maintainer-change): Same historical maintainer transfer, stable across versions.	ai	2026/07/24
publish-pattern	dormant-publish	AI (publish-pattern): Dormancy tied to same known transfer event, not a new signal.	ai	2026/07/24
semgrep	semgrep:dynamic-require	AI (semgrep): Loads local preset files by name from a fixed subdirectory; not arbitrary module loading.	ai	2026/04/29
semgrep	semgrep:child-process-import	AI (semgrep): child_process is core to a CI runner tool; expected and documented usage.	ai	2026/04/29
semgrep	semgrep:child-process-spawn	AI (semgrep): Spawning processes is the primary function of a CI utility; not malicious.	ai	2026/04/29

Versions (showing 41 of 41)

Version	Deps	Published
0.15.1	5 / 0	2025-06-25
0.15.0	5 / 0	2025-06-09
0.14.0	5 / 0	2024-06-20
0.13.0	5 / 0	2023-12-15
0.12.0	5 / 0	2023-04-14
0.11.1	5 / 0	2023-04-12
0.11.0	5 / 0	2023-02-21
0.10.0	5 / 0	2022-11-15
0.9.0	5 / 0	2022-02-01
0.8.2	5 / 0	2021-09-28
0.8.1	5 / 0	2021-09-01
0.8.0	5 / 0	2021-06-03
0.7.2	5 / 0	2021-04-29
0.7.1	5 / 0	2021-04-13
0.7.0	5 / 0	2021-02-02
0.6.1	4 / 0	2020-11-11
0.6.0	4 / 0	2020-10-29
0.5.1	4 / 0	2020-10-20
0.5.0	4 / 0	2020-08-20
0.4.4	4 / 0	2020-08-04
0.4.3	4 / 0	2020-07-20
0.4.2	4 / 0	2020-06-26
0.4.1	4 / 0	2020-05-30
0.4.0	4 / 0	2020-05-21
0.3.14	4 / 0	2020-04-28
0.3.13	4 / 0	2020-04-23
0.3.12	4 / 0	2020-03-20
0.3.11	3 / 0	2020-03-19
0.3.10	3 / 0	2020-03-19
0.3.9	3 / 0	2020-02-20
0.3.8	3 / 0	2020-01-14
0.3.7	3 / 0	2019-12-13
0.3.6	3 / 0	2019-12-04
0.3.5	2 / 0	2019-12-02
0.3.4	2 / 0	2019-11-21
0.3.3	2 / 0	2019-11-17
0.3.2	2 / 0	2019-11-12
0.3.1	2 / 0	2019-11-12
0.3.0	2 / 0	2019-11-12
0.2.0	1 / 0	2019-10-28
0.1.0	1 / 0	2019-09-09

v0.14.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.13.0

2 findings

MEDIUM Publisher changed: patrickhulce → hoten (on 2023-12-15, unremoved on npm for 951d) provenance

This version was published by a different npm account (hoten) than the most recent previously approved version (patrickhulce) on 2023-12-15. It has since remained available on npm for 951 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.12.0

2 findings

MEDIUM Publisher changed: patrickhulce → adamraine (on 2023-04-14, unremoved on npm for 1196d) provenance

This version was published by a different npm account (adamraine) than the most recent previously approved version (patrickhulce) on 2023-04-14. It has since remained available on npm for 1196 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.11.1

2 findings

MEDIUM Publisher changed: patrickhulce → adamraine (on 2023-04-12, unremoved on npm for 1198d) provenance

This version was published by a different npm account (adamraine) than the most recent previously approved version (patrickhulce) on 2023-04-12. It has since remained available on npm for 1198 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.11.0

2 findings

MEDIUM Publisher changed: patrickhulce → hoten (on 2023-02-21, unremoved on npm for 1248d) provenance

This version was published by a different npm account (hoten) than the most recent previously approved version (patrickhulce) on 2023-02-21. It has since remained available on npm for 1248 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.10.0

2 findings

MEDIUM Publisher changed: patrickhulce → hoten (on 2022-11-15, unremoved on npm for 1347d) provenance

This version was published by a different npm account (hoten) than the most recent previously approved version (patrickhulce) on 2022-11-15. It has since remained available on npm for 1347 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.9.0

2 findings

MEDIUM Publisher changed: patrickhulce → hoten (on 2022-02-01, unremoved on npm for 1633d) provenance

This version was published by a different npm account (hoten) than the most recent previously approved version (patrickhulce) on 2022-02-01. It has since remained available on npm for 1633 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.8.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.8.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.8.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.7.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.7.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.7.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.6.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.6.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.5.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.5.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.4.4

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.4.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.4.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.4.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.4.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.3.14

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.3.13

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.3.12

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.3.11

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.3.10

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.3.9

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.3.8

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.3.7

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.3.6

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.3.5

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.3.4

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.3.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.3.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.3.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.3.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.2.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.1.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.