@lokalise/backend-expert-http-client No license 15 versions

@lokalise/backend-expert-http-client

npm Repository Homepage

15

Versions

—

License

No

Install Scripts

Missing

Provenance

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.

Maintainers

bodrovismarcocardosolokbotlokalisekibertoadcarlos_gameroaplokalisefilippos.mikropoulosandrew_lokalisedariacmmattfinucanebezlydmitrycasamitjanabartoszdrozd-lokalisejhfedzerikapalillontrpilot-lokalise

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
dependencies	unvetted-dep:layered-loader	AI (dependencies): Legitimate caching library used as a runtime dep in this Lokalise HTTP client; stable pattern across versions.	ai	2026/05/23
phantom-deps	phantom-dep:layered-loader	AI (phantom-deps): Referenced in config files rather than direct imports; stable false positive for this package.	ai	2026/05/23
dependencies	unvetted-dep:@lokalise/fastify-extras	AI (dependencies): Same Lokalise org scope; consistent internal dependency pattern across this package's versions.	ai	2026/05/23
dependencies	unvetted-dep:@lokalise/id-utils	AI (dependencies): Same-org @lokalise scope; internal dependency, not a third-party risk.	ai	2026/05/08
dependencies	unvetted-dep:@lokalise/common-api-schemas	AI (dependencies): Same-org @lokalise scope; internal dependency, not a third-party risk.	ai	2026/05/08
dependencies	unvetted-dep:@lokalise/workspaces-api-schemas	AI (dependencies): Same-org @lokalise scope; internal dependency, not a third-party risk.	ai	2026/05/08
phantom-deps	phantom-dep:@lokalise/common-api-schemas	AI (phantom-deps): Same-org package; phantom-dep heuristic is a stable false positive here.	ai	2026/05/04
phantom-deps	phantom-dep:@lokalise/node-api	AI (phantom-deps): Same-org package; phantom-dep heuristic is a stable false positive here.	ai	2026/05/04
phantom-deps	phantom-dep:fastify-plugin	AI (phantom-deps): Listed in dependencies; referenced in config files — stable false positive for this package.	ai	2026/05/04
bogus-package	bogus-package	AI (bogus-package): Internal @lokalise SDK with 36 versions and a valid GitHub repo; README style issues are not a risk signal.	ai	2026/05/04
phantom-deps	phantom-dep:@lokalise/id-utils	AI (phantom-deps): Same-org package; phantom-dep heuristic is a stable false positive here.	ai	2026/05/04

Versions (showing 15 of 15)

Version	Deps	Published
1.16.0	8 / 10	2026-05-20
1.15.1	8 / 10	2026-05-01
1.15.0	8 / 10	2026-04-30
1.14.0	8 / 10	2026-03-30
1.13.0	8 / 10	2026-03-27
1.12.0	8 / 10	2026-03-25
1.7.3	8 / 10	2025-12-09
1.7.2	8 / 10	2025-11-25
1.7.1	8 / 10	2025-10-27
1.7.0	8 / 10	2025-10-24
1.6.9	8 / 10	2025-10-20
1.6.8	8 / 10	2025-10-14
1.6.3	9 / 9	2025-10-08
1.6.2	10 / 9	2025-10-06
1.4.0	10 / 9	2025-09-16

v1.16.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.15.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.15.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.14.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.13.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.12.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.7.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.7.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.7.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.7.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.6.9

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.6.8

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.6.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.6.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.4.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.