@nocobase/database
<video width="100%" controls> <source src="https://github.com/user-attachments/assets/4d11a87b-00e2-48f3-9bf7-389d21072d13" type="video/mp4"> </video>
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| dependencies | unvetted-dep:sequelize | AI (dependencies): Sequelize is a major, widely-used ORM and a core dependency for a database abstraction package. No malicious signals. | ai | |
| dependencies | unvetted-dep:node-sql-parser | AI (dependencies): node-sql-parser is a well-known SQL parsing library appropriate for a database package. No malicious signals. | ai | |
| dependencies | unvetted-dep:excel-date-to-js | AI (dependencies): Small utility for Excel date conversion; legitimate use in a database layer handling spreadsheet data imports. | ai | |
| semgrep | semgrep:shady-links-raw-ip | AI (semgrep): The raw IP (127.0.0.1) is a localhost loopback used in mock-database.js test infrastructure to coordinate DB test connections. Not an exfiltration or C2 endpoint; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:cron-parser | AI (phantom-deps): cron-parser is declared in package.json; phantom-dep detection is a false positive for this monorepo package. | ai | |
| phantom-deps | phantom-dep:graphlib | AI (phantom-deps): graphlib is declared in package.json and used within the NocoBase monorepo; phantom-dep detection is a false positive for this package structure. | ai | |
| phantom-deps | phantom-dep:async-mutex | AI (phantom-deps): async-mutex is declared in package.json; phantom-dep detection is a false positive for this monorepo package. | ai |
Versions (showing 16 of 16)
| Version | Deps | Published |
|---|---|---|
| 2.0.56 | 23 / 1 | |
| 2.0.55 | 23 / 1 | |
| 2.0.54 | 23 / 1 | |
| 2.0.53 | 23 / 1 | |
| 2.0.52 | 23 / 1 | |
| 2.0.51 | 23 / 1 | |
| 2.0.49 | 23 / 1 | |
| 2.0.48 | 23 / 1 | |
| 2.0.46 | 23 / 1 | |
| 2.0.45 | 23 / 1 | |
| 2.0.44 | 23 / 1 | |
| 2.0.43 | 23 / 1 | |
| 2.0.42 | 23 / 1 | |
| 2.0.41 | 23 / 1 | |
| 2.0.40 | 23 / 1 | |
| 2.0.39 | 23 / 1 |
v2.0.56
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.0.55
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.0.54
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.0.53
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.0.52
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.0.51
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.0.49
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.0.48
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.0.45
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.0.44
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.0.43
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v2.0.42
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v2.0.41
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v2.0.40
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v2.0.39
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.