@modern-js/core
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| typosquat | typosquat.levenshtein:cors | AI (typosquat): @modern-js/core is a legitimate Modern.js framework package, not a typosquat of cors. | ai | |
| bogus-package | bogus-package | AI (bogus-package): Monorepo sub-package with docs hosted externally; README link dump is expected pattern for this org. | ai | |
| phantom-deps | phantom-dep:@swc/helpers | AI (phantom-deps): @swc/helpers is a known implicit runtime dep for SWC-compiled packages; stable false positive. | ai |
Versions (showing 51 of 85)
| Version | Deps | Published |
|---|---|---|
| 2.71.1 | 4 / 9 | |
| 2.71.0 | 4 / 9 | |
| 2.70.8 | 4 / 9 | |
| 2.70.7 | 4 / 9 | |
| 2.70.6 | 4 / 9 | |
| 2.70.5 | 4 / 9 | |
| 2.70.4 | 4 / 9 | |
| 2.70.3 | 4 / 9 | |
| 2.70.2 | 4 / 9 | |
| 2.70.1 | 4 / 9 | |
| 2.70.0 | 4 / 9 | |
| 2.69.7 | 4 / 9 | |
| 2.69.6 | 4 / 9 | |
| 2.69.5 | 4 / 9 | |
| 2.69.4 | 4 / 9 | |
| 2.69.3 | 4 / 9 | |
| 2.69.2 | 4 / 9 | |
| 2.69.1 | 4 / 9 | |
| 2.69.0 | 4 / 9 | |
| 2.68.20 | 4 / 9 | |
| 2.68.19 | 4 / 9 | |
| 2.68.18 | 4 / 9 | |
| 2.68.17 | 4 / 9 | |
| 2.68.16 | 4 / 9 | |
| 2.68.15 | 4 / 9 | |
| 2.68.14 | 4 / 9 | |
| 2.68.13 | 4 / 9 | |
| 2.68.12 | 4 / 9 | |
| 2.68.11 | 4 / 9 | |
| 2.68.10 | 4 / 9 | |
| 2.68.9 | 4 / 9 | |
| 2.68.8 | 4 / 9 | |
| 2.68.7 | 4 / 9 | |
| 2.68.6 | 4 / 9 | |
| 2.68.5 | 4 / 9 | |
| 2.68.4 | 4 / 9 | |
| 2.68.3 | 4 / 9 | |
| 2.68.2 | 4 / 9 | |
| 2.68.1 | 4 / 9 | |
| 2.68.0 | 4 / 9 | |
| 2.67.11 | 4 / 9 | |
| 2.67.10 | 4 / 9 | |
| 2.67.9 | 4 / 9 | |
| 2.67.8 | 4 / 9 | |
| 2.67.7 | 4 / 9 | |
| 2.67.6 | 4 / 9 | |
| 2.67.5 | 4 / 9 | |
| 2.63.4 | 4 / 9 | |
| 2.63.3 | 4 / 9 | |
| 2.63.2 | 4 / 9 | |
| 2.63.1 | 4 / 9 |
v2.71.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.63.4
1 findingThis version was published without provenance, but prior versions were published via CI/CD with attestations. This is a strong signal of a potential account compromise or unauthorized publish. Multiple high-profile registry compromises have exhibited exactly this pattern.
v2.63.3
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v2.63.2
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v2.63.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.