@lowdefy/connection-knex Apache-2.0 11 versions

@lowdefy/connection-knex

npm Repository Homepage

11

Versions

Apache-2.0

License

No

Install Scripts

Verified

Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures No source commit

Maintainers

samtolmaygervwykmachielvdw

Keywords

lowdefylowdefy connectionlowdefy plugin

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
npm-metadata	no-description	AI (npm-metadata): Stable pattern across Lowdefy plugin packages; not a malware indicator here.	ai	2026/05/29
provenance	publisher-changed	AI (provenance): Transition to GitHub Actions CI publisher with SLSA attestation; consistent with lowdefy monorepo CI migration.	ai	2026/05/29
maintainer-change	maintainer-added	AI (maintainer-change): New maintainer added alongside CI migration; consistent with legitimate org-level change in established package.	ai	2026/05/29
phantom-deps	phantom-dep:tedious	AI (phantom-deps): Same knex driver pattern; not directly imported but required at runtime by knex.	ai	2026/05/27
phantom-deps	phantom-dep:mysql2	AI (phantom-deps): Knex connection plugin lists DB drivers as deps without direct imports; stable pattern for this package.	ai	2026/05/27
phantom-deps	phantom-dep:better-sqlite3	AI (phantom-deps): Same knex driver pattern; not directly imported but required at runtime by knex.	ai	2026/05/27
phantom-deps	phantom-dep:mssql	AI (phantom-deps): Optional knex driver; conditionally loaded via plugin system, not direct import.	ai	2026/04/30
phantom-deps	phantom-dep:sqlite3	AI (phantom-deps): Optional knex driver; conditionally loaded via plugin system, not direct import.	ai	2026/04/30
phantom-deps	phantom-dep:mysql	AI (phantom-deps): Optional knex driver; conditionally loaded via plugin system, not direct import.	ai	2026/04/30
phantom-deps	phantom-dep:pg	AI (phantom-deps): Optional knex driver; conditionally loaded via plugin system, not direct import.	ai	2026/04/30

Versions (showing 11 of 11)

Version	Deps	Published
5.3.0	7 / 6	2026-05-11
5.2.0	7 / 6	2026-04-30
5.1.0	6 / 6	2026-04-20
5.0.0	6 / 6	2026-04-15
4.7.3	6 / 6	2026-03-31
4.7.2	6 / 6	2026-03-25
4.7.1	6 / 6	2026-03-19
4.7.0	6 / 6	2026-03-11
4.6.0	6 / 6	2026-03-09
4.5.2	6 / 6	2025-11-10
4.5.1	6 / 6	2025-11-03

v5.3.0

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v5.2.0

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v5.0.0

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v4.7.3

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v4.7.2

2 findings

HIGH Publisher changed: samtolmay → GitHub Actions (on 2026-03-25) provenance

This version was published by a different npm account than previous versions on 2026-03-25. This could indicate a legitimate maintainer transition or an account compromise.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v4.7.1

2 findings

HIGH Publisher changed: samtolmay → GitHub Actions (on 2026-03-19) provenance

This version was published by a different npm account than previous versions on 2026-03-19. This could indicate a legitimate maintainer transition or an account compromise.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v4.7.0

2 findings

HIGH Publisher changed: samtolmay → GitHub Actions (on 2026-03-11) provenance

This version was published by a different npm account than previous versions on 2026-03-11. This could indicate a legitimate maintainer transition or an account compromise.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v4.6.0

2 findings

HIGH Publisher changed: samtolmay → GitHub Actions (on 2026-03-09) provenance

This version was published by a different npm account than previous versions on 2026-03-09. This could indicate a legitimate maintainer transition or an account compromise.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v4.5.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v4.5.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.