@operato/app
24
Versions
—
License
No
Install Scripts
Missing
Provenance
Supply chain provenance
Status for the latest visible version.
No SLSA provenance
npm registry signatures
gitHead linked
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
heartyohchayeongronggayeon4041jay_leewoo_ramnalshya113
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| typosquat | typosquat.levenshtein:hapi | AI (typosquat): Scoped package @operato/app cannot typosquat bare package hapi; edit-distance match is spurious. | ai | |
| typosquat | typosquat.levenshtein:pg | AI (typosquat): Scoped package @operato/app cannot typosquat bare package pg; edit-distance match is spurious. | ai | |
| typosquat | typosquat.levenshtein:yup | AI (typosquat): Scoped package @operato/app cannot typosquat bare package yup; edit-distance match is spurious. | ai | |
| typosquat | typosquat.levenshtein:ajv | AI (typosquat): Scoped package @operato/app cannot typosquat bare package ajv; edit-distance match is spurious. | ai | |
| phantom-deps | phantom-dep:@operato/shell | AI (phantom-deps): Same-org sibling dep; phantom-dep heuristic unreliable for monorepo packages. | ai | |
| phantom-deps | phantom-dep:@operato/property-panel | AI (phantom-deps): Same-org sibling dep; phantom-dep heuristic unreliable for monorepo packages. | ai | |
| phantom-deps | phantom-dep:codemirror | AI (phantom-deps): codemirror is a declared dep used via config files; phantom-dep heuristic fires on config-only references. | ai | |
| phantom-deps | phantom-dep:graphql-config | AI (phantom-deps): graphql-config declared dep used in config files; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:@codemirror/state | AI (phantom-deps): Declared dep referenced in config files; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:@graphql-tools/delegate | AI (phantom-deps): Declared dep; phantom-dep heuristic fires on config-only references, stable false positive. | ai |
Versions (showing 24 of 24)
| Version | Deps | Published |
|---|---|---|
| 9.2.29 | 29 / 17 | |
| 9.2.28 | 29 / 17 | |
| 9.2.27 | 29 / 17 | |
| 9.2.26 | 29 / 17 | |
| 9.2.25 | 29 / 17 | |
| 9.2.23 | 29 / 17 | |
| 9.2.22 | 29 / 17 | |
| 9.2.21 | 29 / 17 | |
| 9.2.20 | 29 / 17 | |
| 9.2.19 | 29 / 17 | |
| 9.2.14 | 29 / 17 | |
| 9.2.13 | 29 / 17 | |
| 9.2.6 | 29 / 17 | |
| 9.2.5 | 29 / 17 | |
| 9.2.1 | 29 / 17 | |
| 9.2.0 | 29 / 17 | |
| 8.2.20 | 28 / 17 | |
| 8.2.19 | 28 / 17 | |
| 8.2.18 | 28 / 17 | |
| 8.2.17 | 28 / 17 | |
| 8.2.16 | 28 / 17 | |
| 8.2.15 | 28 / 17 | |
| 8.2.14 | 28 / 17 | |
| 8.2.13 | 28 / 17 |
v9.2.29
1 finding
LOW
No provenance attestation
provenance
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.2.28
1 finding
LOW
No provenance attestation
provenance
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.