@nativescript-community/text
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| typosquat | typosquat.levenshtein:next | AI (typosquat): Scoped NativeScript community package; no resemblance to 'next' beyond edit distance on short suffix. | ai | |
| typosquat | typosquat.levenshtein:nuxt | AI (typosquat): Same reasoning; scoped package with long history, not a nuxt typosquat. | ai | |
| typosquat | typosquat.levenshtein:jest | AI (typosquat): Same reasoning; scoped package with long history, not a jest typosquat. | ai |
Versions (showing 13 of 13)
| Version | Deps | Published |
|---|---|---|
| 1.6.25 | 0 / 0 | |
| 1.6.24 | 0 / 0 | |
| 1.6.23 | 0 / 0 | |
| 1.6.22 | 0 / 0 | |
| 1.6.21 | 0 / 0 | |
| 1.6.20 | 0 / 0 | |
| 1.6.19 | 0 / 0 | |
| 1.6.18 | 0 / 0 | |
| 1.6.17 | 0 / 0 | |
| 1.6.16 | 0 / 0 | |
| 1.6.15 | 0 / 0 | |
| 1.6.14 | 0 / 0 | |
| 1.6.8 | 0 / 0 |
v1.6.25
2 findingsPackage name '@nativescript-community/text' is 1 edit(s) away from popular package 'next'.
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.6.24
2 findingsPackage name '@nativescript-community/text' is 1 edit(s) away from popular package 'next'.
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.6.23
2 findingsPackage name '@nativescript-community/text' is 1 edit(s) away from popular package 'next'.
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.6.22
2 findingsPackage name '@nativescript-community/text' is 1 edit(s) away from popular package 'next'.
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.6.21
2 findingsPackage name '@nativescript-community/text' is 1 edit(s) away from popular package 'next'.
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.6.20
2 findingsPackage name '@nativescript-community/text' is 1 edit(s) away from popular package 'next'.
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.6.19
2 findingsPackage name '@nativescript-community/text' is 1 edit(s) away from popular package 'next'.
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.6.18
2 findingsPackage name '@nativescript-community/text' is 1 edit(s) away from popular package 'next'.
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.6.17
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.6.16
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.6.15
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.6.14
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.6.8
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.