← Home

@osdk/foundry.thirdpartyapplications

npm Repository Homepage
75
Versions
—
License
No
Install Scripts
Verified
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures No source commit

Maintainers

sauravsanjpalantirericandersonericjeney-palantir

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
provenance publisher-changed AI (provenance): Transition from individual (ericanderson) to org account (palantir) is a documented Palantir consolidation; stable going forward. ai
publish-pattern dormant-publish AI (publish-pattern): Dormancy explained by publisher account migration; package is part of active Palantir OSDK monorepo with 104 versions. ai

Versions (showing 75 of 75)

Version Deps Published
2.69.0 4 / 2
2.68.0 4 / 2
2.67.0 4 / 2
2.66.0 4 / 2
2.65.0 4 / 2
2.64.0 4 / 2
2.63.0 4 / 2
2.62.0 4 / 2
2.61.0 4 / 2
2.60.0 4 / 2
2.59.0 4 / 2
2.58.0 4 / 2
2.57.0 4 / 2
2.56.0 4 / 2
2.55.0 4 / 2
2.54.0 4 / 2
2.53.0 4 / 2
2.52.0 4 / 2
2.51.0 4 / 2
2.50.0 4 / 2
2.49.0 4 / 2
2.48.0 4 / 2
2.47.0 4 / 2
2.46.0 4 / 2
2.45.0 4 / 2
2.44.0 4 / 2
2.43.0 4 / 2
2.42.0 4 / 2
2.41.0 4 / 2
2.40.0 4 / 2
2.39.0 4 / 2
2.38.0 4 / 2
2.37.0 4 / 2
2.36.0 4 / 2
2.35.0 4 / 2
2.34.0 4 / 2
2.33.0 4 / 2
2.32.0 4 / 2
2.31.0 4 / 2
2.30.0 4 / 2
2.29.0 4 / 2
2.28.0 4 / 2
2.27.0 4 / 2
2.26.0 4 / 2
2.25.0 4 / 2
2.24.0 4 / 2
2.23.0 4 / 2
2.22.0 4 / 2
2.21.0 4 / 2
2.20.0 4 / 2
2.19.0 4 / 2
2.18.0 4 / 2
2.17.0 4 / 2
2.16.0 4 / 2
2.15.0 4 / 2
2.14.0 4 / 2
2.13.0 4 / 2
2.12.0 4 / 2
2.11.0 4 / 2
2.10.0 4 / 2
2.9.0 4 / 2
2.8.0 4 / 2
2.7.0 4 / 2
2.6.0 4 / 2
2.5.0 4 / 2
2.4.0 4 / 2
2.3.0 4 / 2
2.2.0 4 / 2
2.1.1 3 / 4
2.1.0 3 / 4
2.0.4 3 / 4
2.0.3 3 / 4
2.0.2 3 / 4
2.0.1 3 / 4
2.0.0 3 / 4

v2.69.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v2.68.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v2.67.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v2.66.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v2.19.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.18.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.17.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.16.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.15.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.14.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.13.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.12.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.11.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.10.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.9.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.8.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.7.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.6.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.5.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.4.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.3.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.2.0

2 findings
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: palantir → ericanderson (on 2024-10-15, known maintainer) provenance

This version was published by a different npm account (ericanderson) than the most recent previously approved version (palantir) on 2024-10-15, but ericanderson is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

v2.1.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.1.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.0.3

2 findings
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: ericanderson → palantir (on 2025-02-25, known maintainer) provenance

This version was published by a different npm account (palantir) than the most recent previously approved version (ericanderson) on 2025-02-25, but palantir is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

v2.0.2

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.0.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.0.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.