@openfin/core
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| provenance | publisher-changed | AI (provenance): Move to GitHub Actions CI publishing is a legitimate automation transition, not compromise. | ai | |
| provenance | missing-githead | AI (provenance): Known maintainer manual publish; no behavioral evidence of tampering. | ai | |
| phantom-deps | phantom-dep:tslib | AI (phantom-deps): tslib is a well-known TypeScript runtime helper; stable false positive for this package. | ai | |
| publish-pattern | new-deps-added | AI (publish-pattern): es-toolkit is a well-established utility library replacing lodash; not a suspicious dependency addition. | ai | |
| source-diff | net-exec-file:out/stub.mjs | AI (source-diff): stub.mjs is the ESM build artifact of the OpenFin SDK; network calls and dynamic execution are part of the SDK's normal IPC/runtime bridge, not malware. | ai | |
| phantom-deps | phantom-dep:openfin-adapter | AI (phantom-deps): Bundled monorepo dep; not directly imported but included via bundleDependencies. | ai | |
| npm-metadata | url-dep:openfin-adapter | AI (npm-metadata): file: dep is a monorepo bundled dependency (listed in bundleDependencies); stable pattern for this package. | ai | |
| dependencies | unvetted-dep:openfin-adapter | AI (dependencies): Monorepo file: reference bundled into the package; not a registry bypass risk. | ai | |
| typosquat | typosquat.levenshtein:cors | AI (typosquat): @openfin/core is a legitimate scoped package from OpenFin, not a typosquat of 'cors'. | ai | |
| phantom-deps | phantom-dep:@types/node | AI (phantom-deps): @types/node is a type-only dep loaded by convention; phantom-dep finding is expected and benign. | ai | |
| phantom-deps | phantom-dep:ws | AI (phantom-deps): ws is a declared runtime dep used by the OpenFin runtime layer; phantom-dep heuristic is a false positive here. | ai | |
| semgrep | semgrep:api-obfuscation-reflect | AI (semgrep): Reflect.get() used in a proxy/stub pattern in out/stub.js; not obfuscation. | ai |
Versions (showing 31 of 231)
| Version | Deps | Published |
|---|---|---|
| 43.100.39 | 4 / 0 | |
| 43.100.38 | 4 / 0 | |
| 43.100.37 | 4 / 0 | |
| 43.100.36 | 4 / 0 | |
| 43.100.35 | 4 / 0 | |
| 43.100.32 | 4 / 0 | |
| 43.100.29 | 4 / 0 | |
| 43.100.28 | 4 / 0 | |
| 43.100.27 | 4 / 0 | |
| 43.100.26 | 4 / 0 | |
| 43.100.23 | 4 / 0 | |
| 43.100.22 | 4 / 0 | |
| 43.100.20 | 4 / 0 | |
| 43.100.17 | 4 / 0 | |
| 43.100.15 | 4 / 0 | |
| 43.100.11 | 4 / 0 | |
| 43.100.10 | 4 / 0 | |
| 43.100.9 | 4 / 0 | |
| 43.100.8 | 4 / 0 | |
| 43.100.6 | 4 / 0 | |
| 43.100.5 | 4 / 0 | |
| 43.100.3 | 4 / 0 | |
| 42.104.2 | 4 / 0 | |
| 42.103.4 | 4 / 0 | |
| 42.103.3 | 4 / 0 | |
| 42.103.2 | 4 / 0 | |
| 42.103.1 | 4 / 0 | |
| 41.103.9 | 5 / 0 | |
| 40.105.12 | 5 / 0 | |
| 40.105.11 | 5 / 0 | |
| 34.78.93 | 4 / 7 |
v40.105.12
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v40.105.11
3 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: openfin-ci.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (openfin-ci) than the most recent previously approved version (michaelmcoates) on 2026-07-09, but openfin-ci is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.