@orchesty/nodejs-sdk
16
Versions
Apache-2.0
License
No
Install Scripts
Missing
Provenance
Supply chain provenance
Status for the latest visible version.
No SLSA provenance
npm registry signatures
No source commit
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
jirsarradek-bruha
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| publish-pattern | dormant-publish | AI (publish-pattern): Established SDK with 161 versions and 119 approved dependents; dormancy followed by minor patch is consistent with normal maintenance cadence. | ai | |
| dependencies | unvetted-dep:node-redis-connection-pool | AI (dependencies): Redis connection pooling utility; no malware indicators or advisories; stable dependency for this SDK. | ai | |
| dependencies | unvetted-dep:object-traversal | AI (dependencies): Small utility library; no malware indicators or advisories; stable dependency for this SDK. | ai | |
| provenance | no-provenance | AI (provenance): Long-lived package with 160 versions; no provenance is consistent with its publishing history. | ai | |
| npm-metadata | no-description | AI (npm-metadata): Established SDK package; empty description is a cosmetic issue, not a malware indicator. | ai | |
| phantom-deps | phantom-dep:prom-client | AI (phantom-deps): prom-client is a peer/transitive dep of express-prom-bundle; indirect usage is expected for this SDK. | ai | |
| phantom-deps | phantom-dep:fast-xml-parser | AI (phantom-deps): Likely used via config/type references in the SDK; stable false positive for this package. | ai |
Versions (showing 16 of 16)
| Version | Deps | Published |
|---|---|---|
| 5.0.12 | 18 / 22 | |
| 5.0.11 | 19 / 22 | |
| 5.0.10 | 19 / 22 | |
| 5.0.9 | 19 / 20 | |
| 5.0.8 | 19 / 20 | |
| 5.0.7 | 19 / 20 | |
| 5.0.6 | 19 / 20 | |
| 5.0.5 | 19 / 20 | |
| 5.0.4 | 19 / 20 | |
| 5.0.3 | 19 / 20 | |
| 5.0.2 | 19 / 20 | |
| 5.0.1 | 19 / 20 | |
| 5.0.0 | 19 / 20 | |
| 4.3.6 | 19 / 21 | |
| 4.3.5 | 19 / 21 | |
| 4.3.4 | 19 / 21 |
v5.0.12
1 finding
INFO
No provenance attestation
provenance
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.0.11
1 finding
INFO
No provenance attestation
provenance
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.