All @orion-js/helpers versions
@orion-js/helpers @4.2.0
rejected
This version was rejected.
It did not pass GreenFlagged's security review and is not served by the registry.
The findings and risk dispositions below explain why.
49
Risk Score
—
License
No
Install Scripts
1
Dependencies
4
Dev Dependencies
18.4 KB
Package Size
Published
Maintainers
nicolaslopezjjaletelierregn
Dependencies (1)
| Package | Constraint | Registry Status |
|---|---|---|
| uuid | ^11.1.0 | auto_approved |
Dev Dependencies (4)
| Package | Constraint | Registry Status |
|---|---|---|
| tsup | ^8.0.1 | auto_approved |
| vitest | ^3.0.8 | auto_approved |
| typescript | ^5.4.5 | auto_approved |
| @types/node | ^18.0.0 | auto_approved |
Transitive Dependency Tree
1 transitive deps
max depth 1
├─
uuid
^11.1.0
→ 11.1.0
Changes from v4.0.1
No metadata changes detected.
File Changes
0 added
0 removed
5 modified
size delta: +.1 KB
Risk Dispositions (1 applicable to this version, 2 other)
Accepted rules are downgraded to INFO on future analyses; rejected rules escalate to CRITICAL.
| Rule | Source | Disposition | Author | Reason | |
|---|---|---|---|---|---|
dormant-publish |
publish-pattern | reject | AI | AI (publish-pattern): 1756-day dormancy followed by publisher change is a canonical account-takeover pattern. |
Show 2 disposition(s) that do not match any finding on this version
| Rule | Source | Disposition | Author | Reason | |
|---|---|---|---|---|---|
publisher-changed |
provenance | reject | AI | AI (provenance): New publisher with zero track record after years of dormancy; strong takeover indicator for this package. | |
new-deps-added |
publish-pattern | reject | AI | AI (publish-pattern): kafkajs added to a helpers package with no direct imports matches supply-chain injection pattern. |
SAST Findings (1)
LOW
No provenance attestation
provenance
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
Review Summary
Risk score: 49. Findings: 1 critical (+40), 3 low (+9), 1 info (+0).
Commit: a485b1fe6a18
Published to npm: