@open-tender/utils
A library of utils for use with Open Tender applications that utilize our cloud-based Order API.
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| maintainer-change | maintainer-added | AI (maintainer-change): Publisher matches existing maintainer name, consistent with legitimate manual publish. | ai | |
| provenance | missing-githead | AI (provenance): Byproduct of same publisher transition, no malicious change in diff. | ai | |
| publish-pattern | new-deps-added | AI (publish-pattern): date-fns/date-fns-tz are established, widely-used date utilities fitting the package's purpose. | ai | |
| provenance | publisher-changed | AI (provenance): Long-tenured publisher with strong approval history; change predates this version. | ai |
Versions (showing 51 of 140)
| Version | Deps | Published |
|---|---|---|
| 0.5.72 | 2 / 21 | |
| 0.5.71 | 2 / 21 | |
| 0.5.70 | 2 / 20 | |
| 0.5.69 | 2 / 20 | |
| 0.5.68 | 2 / 20 | |
| 0.5.67 | 2 / 20 | |
| 0.5.66 | 2 / 20 | |
| 0.5.64 | 2 / 20 | |
| 0.5.63 | 2 / 20 | |
| 0.5.62 | 2 / 20 | |
| 0.5.61 | 2 / 20 | |
| 0.5.60 | 2 / 20 | |
| 0.5.59 | 2 / 20 | |
| 0.5.58 | 2 / 20 | |
| 0.5.57 | 2 / 20 | |
| 0.5.56 | 2 / 20 | |
| 0.5.55 | 2 / 20 | |
| 0.5.54 | 2 / 20 | |
| 0.5.53 | 2 / 20 | |
| 0.5.52 | 2 / 20 | |
| 0.5.51 | 2 / 20 | |
| 0.5.50 | 2 / 20 | |
| 0.5.49 | 2 / 20 | |
| 0.5.48 | 2 / 20 | |
| 0.5.47 | 2 / 20 | |
| 0.5.46 | 2 / 20 | |
| 0.5.45 | 2 / 20 | |
| 0.5.44 | 2 / 20 | |
| 0.5.43 | 2 / 20 | |
| 0.5.42 | 2 / 20 | |
| 0.5.41 | 2 / 20 | |
| 0.5.40 | 2 / 20 | |
| 0.5.39 | 2 / 20 | |
| 0.5.38 | 2 / 20 | |
| 0.5.37 | 2 / 20 | |
| 0.5.36 | 2 / 20 | |
| 0.5.35 | 2 / 20 | |
| 0.5.34 | 2 / 20 | |
| 0.5.33 | 2 / 20 | |
| 0.5.32 | 2 / 20 | |
| 0.5.31 | 2 / 20 | |
| 0.5.30 | 2 / 20 | |
| 0.5.29 | 2 / 20 | |
| 0.5.28 | 2 / 20 | |
| 0.5.27 | 2 / 20 | |
| 0.5.26 | 2 / 20 | |
| 0.5.25 | 2 / 20 | |
| 0.5.24 | 2 / 20 | |
| 0.5.23 | 2 / 20 | |
| 0.5.22 | 2 / 20 | |
| 0.5.21 | 2 / 20 |
v0.5.72
3 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: luong-iacm.
This version was published by a different npm account than previous versions on 2026-07-07. This could indicate a legitimate maintainer transition or an account compromise.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.5.71
3 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: luong-iacm.
This version was published by a different npm account than previous versions on 2026-06-29. This could indicate a legitimate maintainer transition or an account compromise.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.5.58
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (shady.abdelaziz.farahat) than the most recent previously approved version (nasser_md) on 2025-10-28, but shady.abdelaziz.farahat is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v0.5.30
3 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: nasser_md.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (nasser_md) than the most recent previously approved version (shady.abdelaziz.farahat) on 2025-04-22, but nasser_md is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v0.5.29
3 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: nasser_md.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (nasser_md) than the most recent previously approved version (shady.abdelaziz.farahat) on 2025-04-18, but nasser_md is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v0.5.28
3 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: nasser_md.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (nasser_md) than the most recent previously approved version (shady.abdelaziz.farahat) on 2025-04-14, but nasser_md is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v0.5.27
3 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: nasser_md.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (nasser_md) than the most recent previously approved version (shady.abdelaziz.farahat) on 2025-04-14, but nasser_md is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v0.5.26
3 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: nasser_md.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (nasser_md) than the most recent previously approved version (shady.abdelaziz.farahat) on 2025-03-31, but nasser_md is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v0.5.25
3 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: nasser_md.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (nasser_md) than the most recent previously approved version (shady.abdelaziz.farahat) on 2025-03-25, but nasser_md is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v0.5.24
3 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: nasser_md.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (nasser_md) than the most recent previously approved version (shady.abdelaziz.farahat) on 2025-02-24, but nasser_md is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v0.5.23
3 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: nasser_md.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (nasser_md) than the most recent previously approved version (shady.abdelaziz.farahat) on 2025-02-24, but nasser_md is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v0.5.22
3 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: nasser_md.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (nasser_md) than the most recent previously approved version (shady.abdelaziz.farahat) on 2025-02-24, but nasser_md is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v0.5.21
3 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: nasser_md.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (nasser_md) than the most recent previously approved version (shady.abdelaziz.farahat) on 2025-02-24, but nasser_md is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.