@oh-my-pi/pi-utils MIT 51 versions

@oh-my-pi/pi-utils

npm Repository Homepage

Shared utilities for pi packages

51

Versions

MIT

License

No

Install Scripts

Verified

Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures No source commit

Maintainers

can1357

Keywords

utilitiescliloggingstreams

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
publish-pattern	new-deps-added	AI (publish-pattern): New dep is a same-org sibling package at matching version from the same trusted publisher; not a suspicious third-party addition.	ai	2026/05/27
semgrep	semgrep:env-spread	AI (semgrep): Spreading process.env into spawn options is standard for shell process managers; not exfiltration.	ai	2026/05/04
provenance	missing-githead	AI (provenance): Publisher appears to have switched to local publish workflow; no other risk signals present.	ai	2026/05/04
dependencies	unvetted-dep:handlebars	AI (dependencies): handlebars is a well-known, established templating library; not a supply-chain risk for this package.	ai	2026/04/30
provenance	no-provenance	AI (provenance): Provenance absence is common (~88% of npm); no other risk signals present for this package.	ai	2026/04/29

Versions (showing 51 of 320)

View all versions

Version	Deps	Published
17.1.5	4 / 1	2026/07/27
17.1.4	4 / 1	2026/07/26
17.1.3	4 / 1	2026-07-24
17.1.2	4 / 1	2026-07-24
17.1.1	4 / 1	2026-07-24
17.1.0	4 / 1	2026/07/24
17.0.9	4 / 1	2026-07-23
17.0.8	4 / 1	2026-07-23
17.0.7	4 / 1	2026-07-21
17.0.6	4 / 1	2026-07-20
17.0.5	4 / 1	2026-07-18
17.0.4	4 / 1	2026/07/18
17.0.3	4 / 1	2026-07-17
17.0.2	4 / 1	2026-07-17
17.0.1	4 / 1	2026/07/16
17.0.0	4 / 1	2026-07-15
16.5.2	4 / 1	2026-07-14
16.5.1	4 / 1	2026-07-14
16.5.0	4 / 1	2026-07-14
16.4.8	4 / 1	2026-07-12
16.4.6	4 / 1	2026-07-12
16.4.5	4 / 1	2026-07-11
16.4.4	4 / 1	2026-07-11
15.4.1	5 / 1	2026-05-26
15.2.4	5 / 1	2026-05-22
15.1.8	5 / 1	2026-05-20
15.1.5	5 / 1	2026-05-19
15.1.2	4 / 2	2026-05-15
15.1.0	4 / 2	2026-05-15
15.0.1	4 / 2	2026-05-14
15.0.0	4 / 2	2026-05-13
14.9.5	4 / 2	2026-05-12
14.9.3	4 / 2	2026-05-10
14.9.2	4 / 2	2026-05-10
14.9.1	4 / 2	2026-05-10
14.9.0	4 / 2	2026-05-10
14.8.1	4 / 2	2026-05-09
14.8.0	4 / 2	2026-05-09
14.7.6	4 / 2	2026-05-08
14.7.5	4 / 2	2026-05-07
14.7.4	4 / 2	2026-05-07
14.7.3	4 / 2	2026-05-06
14.7.0	4 / 2	2026-05-05
14.6.6	4 / 2	2026-05-04
14.6.5	4 / 2	2026-05-03
14.6.4	4 / 2	2026-05-03
14.6.3	4 / 2	2026-05-03
14.6.2	4 / 2	2026-05-03
14.6.1	4 / 2	2026-05-02
14.6.0	4 / 2	2026-05-02
14.5.14	4 / 2	2026-05-01

v17.1.5

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v17.1.4

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v17.1.3

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v17.1.2

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v17.1.1

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v17.1.0

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v17.0.9

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v17.0.8

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v17.0.7

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v17.0.6

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v17.0.5

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v17.0.4

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v17.0.3

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v17.0.2

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v17.0.1

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v17.0.0

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v16.5.2

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v16.5.1

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v16.5.0

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v16.4.8

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v16.4.6

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v16.4.5

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v16.4.4

2 findings

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

INFO Publisher changed: can1357 → GitHub Actions (on 2026-07-11, now via trusted publisher with provenance) provenance

This version was published by a different npm account (GitHub Actions) than the most recent previously approved version (can1357) on 2026-07-11, but it carries Sigstore provenance attestation. This means the package moved to a trusted publisher (CI/CD with OIDC, e.g. GitHub Actions) — a supply-chain integrity improvement, not a compromise, since a stolen npm token cannot forge provenance bound to the source repository. Recorded as INFO for audit trail.