@openturn/bot
15
Versions
Apache-2.0
License
No
Install Scripts
Verified
Provenance
Supply chain provenance
Status for the latest visible version.
SLSA provenance attestation
npm registry signatures
gitHead linked
Maintainers
jamesjczhang
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| provenance | publisher-changed | AI (provenance): Publisher is GitHub Actions with SLSA provenance; CI/CD automation is the documented publish mechanism for this org. | ai | |
| npm-metadata | no-description | AI (npm-metadata): Young monorepo package in active development; missing description is cosmetic. | ai | |
| typosquat | typosquat.levenshtein:joi | AI (typosquat): Scoped @openturn package; Levenshtein match to 'joi' is coincidental. | ai | |
| typosquat | typosquat.levenshtein:got | AI (typosquat): Scoped @openturn package in a legitimate monorepo; not a typosquat of 'got'. | ai | |
| phantom-deps | phantom-dep:@openturn/json | AI (phantom-deps): Same-org sibling dep in a monorepo; phantom-dep heuristic is a stable false positive here. | ai | |
| typosquat | typosquat.levenshtein:zod | AI (typosquat): Scoped @openturn package; Levenshtein match to 'zod' is coincidental. | ai | |
| typosquat | typosquat.levenshtein:koa | AI (typosquat): Scoped @openturn package; Levenshtein match to 'koa' is coincidental. | ai |