@microsoft/sp-http-base
5
Versions
—
License
No
Install Scripts
Missing
Provenance
Supply chain provenance
Status for the latest visible version.
No SLSA provenance
npm registry signatures
No source commit
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
microsoft1esmicrosoft-oss-releaseskevintcoughlinodspnpm
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| maintainer-change | maintainer-added | AI (maintainer-change): microsoft-oss-releases is a standard Microsoft OSS release automation account; expected for this org's packages. | ai | |
| source-diff | net-exec-file:dist/sp-http-base_en-us_cdf411e22d5c0698f4a1.js | AI (source-diff): AMD define() + HTTP calls are the expected SPFx bundle pattern; not dropper behavior. | ai | |
| source-diff | obfuscated-file:dist/sp-http-base_qps-ploc_f04e92c438ad6c7376c8.js | AI (source-diff): Locale-variant minified SPFx bundle; same pattern as other locale files in this package. | ai | |
| source-diff | net-exec-file:dist/sp-http-base_qps-ploc_f04e92c438ad6c7376c8.js | AI (source-diff): AMD define() + HTTP calls are the expected SPFx bundle pattern; not dropper behavior. | ai | |
| source-diff | obfuscated-file:dist/sp-http-base_qps-ploca_23b820b6dd404f068d2c.js | AI (source-diff): Locale-variant minified SPFx bundle; same pattern as other locale files in this package. | ai | |
| source-diff | net-exec-file:dist/sp-http-base_qps-ploca_23b820b6dd404f068d2c.js | AI (source-diff): AMD define() + HTTP calls are the expected SPFx bundle pattern; not dropper behavior. | ai | |
| source-diff | obfuscated-file:dist/sp-http-base_default_3e5c8f5efdcb94a1dc54.js | AI (source-diff): Standard minified webpack/AMD bundle for SPFx; pattern is consistent across all locale variants in this package. | ai | |
| source-diff | net-exec-file:dist/sp-http-base_default_3e5c8f5efdcb94a1dc54.js | AI (source-diff): AMD define() + HTTP calls are the expected SPFx bundle pattern; not dropper behavior. | ai | |
| source-diff | obfuscated-file:dist/sp-http-base_en-us_cdf411e22d5c0698f4a1.js | AI (source-diff): Locale-variant minified SPFx bundle; same pattern as other locale files in this package. | ai | |
| dependencies | unvetted-dep:adal-angular | AI (dependencies): adal-angular is a known Microsoft Azure AD library; expected dependency for AAD auth in SPFx. | ai | |
| dependencies | unvetted-dep:@microsoft/teams-js-v2 | AI (dependencies): Microsoft Teams JS SDK aliased via npm; expected dependency for Teams integration in SPFx. | ai | |
| phantom-deps | phantom-dep:@microsoft/teams-js-v2 | AI (phantom-deps): Same-org alias dependency; declared but conditionally imported — stable false positive for this package. | ai | |
| bogus-package | bogus-package | AI (bogus-package): Established Microsoft SPFx SDK package; sparse README/keywords are typical for internal SDK modules. | ai | |
| phantom-deps | phantom-dep:@swc/helpers | AI (phantom-deps): Known implicit runtime dependency for SWC-compiled packages; stable false positive for this package. | ai |