@opencode-ai/sdk
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| npm-metadata | no-description | AI (npm-metadata): Auto-generated SDK package; missing description is a metadata hygiene issue, not a malware signal. Stable for this package. | ai | |
| bogus-package | bogus-package | AI (bogus-package): Scoped SDK with 4.1M downloads and 6298 versions; low-value metadata signals are false positives for this established package. | ai |
Versions (showing 51 of 259)
| Version | Deps | Published |
|---|---|---|
| 1.18.7 | 1 / 6 | |
| 1.18.6 | 1 / 6 | |
| 1.18.5 | 1 / 6 | |
| 1.18.4 | 1 / 6 | |
| 1.18.3 | 1 / 6 | |
| 1.18.2 | 1 / 6 | |
| 1.18.1 | 1 / 6 | |
| 1.18.0 | 1 / 6 | |
| 1.17.20 | 1 / 6 | |
| 1.17.19 | 1 / 6 | |
| 1.17.18 | 1 / 6 | |
| 1.17.17 | 1 / 6 | |
| 1.17.16 | 1 / 6 | |
| 1.17.15 | 1 / 6 | |
| 1.17.14 | 1 / 6 | |
| 1.17.13 | 1 / 6 | |
| 1.17.12 | 1 / 6 | |
| 1.17.11 | 1 / 6 | |
| 1.17.10 | 1 / 6 | |
| 1.17.9 | 1 / 6 | |
| 1.17.8 | 1 / 6 | |
| 1.17.7 | 1 / 6 | |
| 1.17.6 | 1 / 6 | |
| 1.17.5 | 1 / 6 | |
| 1.17.4 | 1 / 6 | |
| 1.17.3 | 1 / 6 | |
| 1.17.2 | 1 / 6 | |
| 1.17.1 | 1 / 6 | |
| 1.17.0 | 1 / 6 | |
| 1.16.2 | 1 / 6 | |
| 1.16.1 | 1 / 6 | |
| 1.16.0 | 1 / 6 | |
| 1.15.13 | 1 / 6 | |
| 1.15.12 | 1 / 6 | |
| 1.15.11 | 1 / 6 | |
| 1.15.10 | 1 / 6 | |
| 1.15.9 | 1 / 6 | |
| 1.15.8 | 1 / 6 | |
| 1.15.7 | 1 / 6 | |
| 1.15.6 | 1 / 6 | |
| 1.15.5 | 1 / 6 | |
| 1.15.4 | 1 / 6 | |
| 1.15.3 | 1 / 6 | |
| 1.15.2 | 1 / 6 | |
| 1.15.1 | 1 / 6 | |
| 1.15.0 | 1 / 6 | |
| 1.14.51 | 1 / 6 | |
| 1.14.50 | 1 / 6 | |
| 1.14.49 | 1 / 6 | |
| 1.14.48 | 1 / 6 | |
| 1.14.47 | 1 / 6 |
v1.18.7
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.18.6
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.18.5
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.18.4
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.18.3
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.18.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.18.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.18.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.17.20
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.17.19
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.17.18
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.17.17
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.17.16
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.17.15
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.17.14
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.17.13
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.17.12
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.