@lumino/dragdrop — Greenflagged

Lumino Drag and Drop

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures No source commit

Maintainers

blink1073ellisonbgdarianjasongroutjtpiofcollonvalkrassowski

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
provenance	missing-githead	AI (provenance): Established JupyterLab ecosystem package with strong publisher track record; missing gitHead reflects a publish environment change, not a security concern for this package.	ai	2026/04/24
provenance	publisher-changed	AI (provenance): Publisher change from fcollonval to jupyterlab-release-bot is a known, legitimate migration to JupyterLab's official release automation account with a strong track record (3583 approved, 0 rejected).	ai	2026/04/24

Versions (showing 40 of 40)

Version	Deps	Published
2.1.8	2 / 19	2026-02-05
2.1.7	2 / 19	2025-11-13
2.1.6	2 / 19	2025-03-31
2.1.5	2 / 19	2024-06-28
2.1.4	2 / 25	2023-11-05
2.1.3	2 / 25	2023-07-27
2.1.2	2 / 26	2023-06-23
2.1.1	2 / 26	2023-04-27
2.1.0	2 / 26	2023-04-07
2.0.0	2 / 26	2023-03-15
1.14.5	2 / 27	2023-03-27
1.14.4	2 / 27	2023-01-23
1.14.3	2 / 27	2022-10-31
1.14.2	2 / 27	2022-10-05
1.14.1	2 / 27	2022-08-08
1.14.0	2 / 27	2022-01-10
1.13.1	2 / 27	2021-11-04
1.13.0	2 / 27	2021-10-25
1.12.0	2 / 27	2021-09-30
1.11.0	2 / 27	2021-09-22
1.10.2	2 / 27	2021-08-23
1.10.1	2 / 27	2021-08-12
1.10.0	2 / 27	2021-04-27
1.9.0	2 / 27	2021-04-19
1.8.0	2 / 27	2021-04-09
1.7.1	2 / 27	2020-12-04
1.7.0	2 / 27	2020-12-01
1.6.4	2 / 27	2020-07-27
1.6.3	2 / 27	2020-07-21
1.6.2	2 / 27	2020-06-26
1.6.1	2 / 27	2020-06-25
1.6.0	2 / 26	2020-05-23
1.5.3	2 / 20	2020-05-12
1.5.2	2 / 20	2020-05-07
1.5.1	2 / 20	2020-02-19
1.5.0	2 / 20	2020-01-08
1.4.4	2 / 20	2020-01-02
1.4.3	2 / 20	2019-12-17
1.4.2	2 / 19	2019-12-09
1.4.1	2 / 18	2019-11-17

v2.1.8

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v2.1.7

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v2.1.6

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v2.1.5

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v2.1.4

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v2.1.3

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v0.2). This is the strongest supply chain integrity signal.

v2.1.2

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v0.2). This is the strongest supply chain integrity signal.

v2.1.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.1.0

2 findings

HIGH Publisher changed: fcollonval → jupyterlab-release-bot (on 2023-04-07) provenance

This version was published by a different npm account than previous versions on 2023-04-07. This could indicate a legitimate maintainer transition or an account compromise.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.0.0

2 findings

HIGH Publisher changed: fcollonval → jupyterlab-release-bot (on 2023-03-15) provenance

This version was published by a different npm account than previous versions on 2023-03-15. This could indicate a legitimate maintainer transition or an account compromise.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.14.5

3 findings

HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: fcollonval.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: jupyterlab-release-bot → fcollonval (on 2023-03-27) provenance

[Accepted risk] This version was published by a different npm account than previous versions on 2023-03-27. This could indicate a legitimate maintainer transition or an account compromise.

v1.14.4

2 findings

HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: fcollonval.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.14.3

3 findings

HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: fcollonval.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: blink1073 → fcollonval (on 2022-10-31) provenance

[Accepted risk] This version was published by a different npm account than previous versions on 2022-10-31. This could indicate a legitimate maintainer transition or an account compromise.

v1.14.2

3 findings

HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: fcollonval.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: jasongrout → fcollonval (on 2022-10-05) provenance

[Accepted risk] This version was published by a different npm account than previous versions on 2022-10-05. This could indicate a legitimate maintainer transition or an account compromise.

v1.14.1

3 findings

HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: fcollonval.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: jasongrout → fcollonval (on 2022-08-08) provenance

[Accepted risk] This version was published by a different npm account than previous versions on 2022-08-08. This could indicate a legitimate maintainer transition or an account compromise.

v1.14.0

3 findings

HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: blink1073.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: jasongrout → blink1073 (on 2022-01-10) provenance

[Accepted risk] This version was published by a different npm account than previous versions on 2022-01-10. This could indicate a legitimate maintainer transition or an account compromise.

v1.13.1

3 findings

HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: jasongrout.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: blink1073 → jasongrout (on 2021-11-04) provenance

[Accepted risk] This version was published by a different npm account than previous versions on 2021-11-04. This could indicate a legitimate maintainer transition or an account compromise.

v1.13.0

2 findings

HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: blink1073.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.12.0

2 findings

HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: blink1073.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.11.0

2 findings

HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: blink1073.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.10.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.10.1

2 findings

HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: blink1073.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.10.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.9.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.8.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.7.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.7.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.6.4

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.6.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.6.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.6.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.6.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.5.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.5.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.5.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.5.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.4.4

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.4.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.4.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.4.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.