← Home

@opentripplanner/core-utils

npm Repository
8
Versions
—
License
No
Install Scripts
Verified
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures gitHead linked

Maintainers

landonreedfpurcellevansirokybinh-dam-ibigroup

Versions (showing 8 of 8)

Version Deps Published
16.0.4 11 / 3
16.0.3 11 / 3
15.0.0 11 / 1
14.3.4 11 / 1
14.3.3 11 / 1
14.3.2 11 / 1
14.3.1 11 / 1
14.3.0 11 / 1

v16.0.4

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v16.0.3

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v15.0.0

2 findings
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: evansiroky → binh-dam-ibigroup (on 2026-01-27, known maintainer) provenance

This version was published by a different npm account (binh-dam-ibigroup) than the most recent previously approved version (evansiroky) on 2026-01-27, but binh-dam-ibigroup is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

v14.3.4

2 findings
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: evansiroky → binh-dam-ibigroup (on 2026-01-07, known maintainer) provenance

This version was published by a different npm account (binh-dam-ibigroup) than the most recent previously approved version (evansiroky) on 2026-01-07, but binh-dam-ibigroup is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

v14.3.3

2 findings
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: evansiroky → binh-dam-ibigroup (on 2026-01-05, known maintainer) provenance

This version was published by a different npm account (binh-dam-ibigroup) than the most recent previously approved version (evansiroky) on 2026-01-05, but binh-dam-ibigroup is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

v14.3.2

2 findings
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: evansiroky → binh-dam-ibigroup (on 2025-12-19, known maintainer) provenance

This version was published by a different npm account (binh-dam-ibigroup) than the most recent previously approved version (evansiroky) on 2025-12-19, but binh-dam-ibigroup is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

v14.3.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v14.3.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.