← Home

@neovici/cosmoz-utils

npm Repository Homepage
30
Versions
—
License
No
Install Scripts
Verified
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures gitHead linked

Maintainers

nomegocristineculawurpermegheaiulian

Keywords

polymerweb-components

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
provenance publisher-changed AI (provenance): Neovici migrated to GitHub Actions publishing with SLSA attestation; this pattern is expected for all future versions. ai
provenance slsa-provenance AI (provenance): Package consistently published via CI/CD with Sigstore attestation; stable supply chain signal. ai

Versions (showing 30 of 30)

Version Deps Published
6.22.2 1 / 13
6.22.1 1 / 13
6.22.0 1 / 15
6.21.0 1 / 13
6.20.2 1 / 13
6.20.1 1 / 13
6.20.0 1 / 13
6.19.0 1 / 13
6.18.0 1 / 13
6.17.2 1 / 13
6.17.1 1 / 13
6.17.0 1 / 12
6.16.1 1 / 12
6.16.0 1 / 12
6.15.1 1 / 12
6.15.0 1 / 12
6.14.2 1 / 12
6.14.1 1 / 12
6.14.0 1 / 12
6.13.3 1 / 12
6.13.2 1 / 12
6.13.1 1 / 12
6.13.0 1 / 12
6.12.1 1 / 12
6.12.0 1 / 12
6.11.0 1 / 12
6.10.1 1 / 12
6.10.0 1 / 12
6.9.1 1 / 12
6.9.0 1 / 12

v6.22.2

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v6.22.1

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v6.13.3

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.13.2

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.13.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.13.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.12.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.12.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.11.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.10.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.10.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.9.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.9.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.