← Home

@openclaw/msteams

npm Repository Homepage

OpenClaw Microsoft Teams channel plugin

45
Versions
—
License
No
Install Scripts
Verified
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures gitHead linked

Maintainers

steipetevincentkoc

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
semgrep semgrep:etc-passwd-access AI (semgrep): Fires in a test file asserting /etc/passwd URLs are rejected — negative test, not credential harvesting. ai
semgrep semgrep:shady-links-raw-ip AI (semgrep): Fires in a test file asserting SSRF to metadata IP is rejected — negative test, not a real request. ai
provenance publisher-changed AI (provenance): Package publishes via GitHub Actions with SLSA provenance; CI/CD publisher is the intended pattern for this package. ai
phantom-deps phantom-dep:@azure/identity AI (phantom-deps): Framework-scoped Azure identity package loaded by convention; stable false positive for this package. ai
semgrep semgrep:env-spread AI (semgrep): Fires in a test file only; spreading process.env to inject a test-specific state dir is a standard test pattern, not a secret leak. ai
semgrep semgrep:base64-decode AI (semgrep): Decoding base64 attachment bytes from MS Graph API is expected behavior for a Teams channel plugin. ai

Versions (showing 45 of 45)

Version Deps Published
2026.7.1 5 / 0
2026.6.11 5 / 0
2026.6.10 5 / 0
2026.6.9 5 / 0
2026.6.8 5 / 0
2026.6.6 5 / 0
2026.6.5 5 / 0
2026.6.1 5 / 0
2026.5.28 5 / 0
2026.5.27 7 / 0
2026.5.26 7 / 0
2026.5.22 7 / 0
2026.5.20 7 / 3
2026.5.19 7 / 3
2026.5.18 7 / 3
2026.5.12 7 / 3
2026.5.7 7 / 3
2026.5.6 7 / 3
2026.5.5 7 / 3
2026.5.4 7 / 3
2026.5.3 7 / 3
2026.5.2 7 / 3
2026.3.13 2 / 0
2026.3.12 2 / 0
2026.3.11 2 / 0
2026.3.10 2 / 0
2026.3.7 2 / 0
2026.3.2 2 / 0
2026.3.1 2 / 0
2026.2.25 2 / 0
2026.2.24 2 / 0
2026.2.23 2 / 1
2026.2.22 2 / 1
2026.2.21 2 / 1
2026.2.19 4 / 1
2026.2.17 4 / 1
2026.2.15 4 / 1
2026.2.14 4 / 1
2026.2.13 5 / 1
2026.2.12 5 / 1
2026.2.9 5 / 1
2026.2.6 6 / 1
2026.2.3 6 / 1
2026.2.2 6 / 1
2026.2.1 6 / 1

v2026.7.1

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v2026.6.11

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v2026.6.10

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.