← Home

@osdk/foundry.ontologies

npm Repository Homepage
51
Versions
—
License
No
Install Scripts
Verified
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures No source commit

Maintainers

sauravsanjpalantirericandersonericjeney-palantir

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
dependencies unvetted-dep:@osdk/foundry.datasets AI (dependencies): First-party sibling package in same monorepo/version, not a third-party dep. ai
publish-pattern new-deps-added AI (publish-pattern): Added dep is an in-org @osdk sibling published at matching version, low risk. ai
provenance publisher-changed AI (provenance): Transition from ericanderson to palantir org account; palantir has strong track record and repo URL confirms official ownership. ai
npm-metadata no-description AI (npm-metadata): Palantir SDK package; missing description is a cosmetic issue, not a malware signal. ai
provenance no-provenance AI (provenance): Established Palantir monorepo package; lack of Sigstore provenance is common and not a risk here. ai

Versions (showing 51 of 70)

View all versions
Version Deps Published
2.69.0 6 / 2
2.68.0 6 / 2
2.67.0 6 / 2
2.66.0 5 / 2
2.65.0 5 / 2
2.64.0 5 / 2
2.63.0 5 / 2
2.62.0 5 / 2
2.61.0 5 / 2
2.60.0 5 / 2
2.59.0 5 / 2
2.58.0 5 / 2
2.57.0 5 / 2
2.56.0 5 / 2
2.55.0 5 / 2
2.54.0 5 / 2
2.53.0 5 / 2
2.52.0 5 / 2
2.51.0 5 / 2
2.50.0 5 / 2
2.49.0 5 / 2
2.48.0 5 / 2
2.47.0 5 / 2
2.46.0 5 / 2
2.45.0 5 / 2
2.44.0 5 / 2
2.43.0 5 / 2
2.42.0 5 / 2
2.41.0 5 / 2
2.40.0 5 / 2
2.39.0 5 / 2
2.38.0 5 / 2
2.37.0 5 / 2
2.36.0 5 / 2
2.35.0 5 / 2
2.34.0 5 / 2
2.33.0 5 / 2
2.32.0 5 / 2
2.31.0 5 / 2
2.30.0 5 / 2
2.29.0 5 / 2
2.28.0 5 / 2
2.27.0 5 / 2
2.26.0 5 / 2
2.25.0 5 / 2
2.24.0 5 / 2
2.23.0 5 / 2
2.22.0 5 / 2
2.21.0 5 / 2
2.20.0 5 / 2
2.19.0 5 / 2

v2.69.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v2.68.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v2.67.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v2.66.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v2.19.0

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.