← Home

@palmetto/solarflare-sdk

npm Repository

SDK for Scalable Notification Service for SMS, Email, Mobile-Push, and Webhooks

20
Versions
UNLICENSED
License
No
Install Scripts
Missing
Provenance

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.

Maintainers

palmettocicharles.sullivan.palmettoarempe-palmettogaschecherpalmettopalmetto-eiisaac.hgonyoda-palmetto

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
dependencies unvetted-dep:@palmetto/result AI (dependencies): First-party @palmetto sibling dependency; consistent with this package's ecosystem. ai
dependencies unvetted-dep:@palmetto/base-sdk-client AI (dependencies): First-party @palmetto sibling dependency; consistent with this package's ecosystem. ai
provenance no-provenance AI (provenance): Internal corporate SDK; provenance attestation not yet adopted by this org, consistent across versions. ai
license uncommon-license:UNLICENSED AI (license): Intentionally proprietary internal SDK; UNLICENSED is expected for this package. ai
phantom-deps phantom-dep:openapi-fetch AI (phantom-deps): openapi-fetch is a declared runtime dep used in generated dist code; phantom-dep heuristic is a false positive here. ai

Versions (showing 20 of 20)

Version Deps Published
0.7.4 3 / 8
0.7.3 3 / 8
0.7.1 3 / 8
0.7.0 3 / 8
0.6.11 3 / 8
0.6.10 3 / 8
0.6.9 3 / 8
0.6.8 3 / 8
0.6.7 3 / 8
0.6.5 3 / 8
0.6.4 3 / 8
0.6.3 3 / 8
0.6.1 3 / 8
0.6.0 3 / 8
0.5.1 3 / 8
0.5.0 3 / 8
0.4.0 3 / 8
0.3.0 3 / 8
0.1.1 3 / 8
0.1.0 3 / 8

v0.7.4

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.