← Home

@pnpm/workspace.injected-deps-syncer

npm Repository Homepage
51
Versions
—
License
No
Install Scripts
Verified
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures No source commit

Maintainers

pnpmuserzkochan

Keywords

pnpmpnpm11

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
provenance regressed-provenance AI (provenance): Likely CI config variance across pnpm's many monorepo packages; publisher has strong long-term track record. ai
publish-pattern new-deps-added AI (publish-pattern): New deps are renamed @pnpm/* sibling packages within the same monorepo, not foreign additions. ai
phantom-deps phantom-dep:@pnpm/types AI (phantom-deps): Same org scope (@pnpm); type-only dep used at build time, not a runtime phantom. ai
phantom-deps phantom-dep:@types/normalize-path AI (phantom-deps): Type definitions package; not directly imported at runtime by convention. ai

Versions (showing 51 of 57)

View all versions
Version Deps Published
1100.0.28 10 / 4
1100.0.27 10 / 4
1100.0.26 10 / 4
1100.0.25 10 / 4
1100.0.24 10 / 4
1100.0.23 10 / 4
1100.0.22 10 / 4
1100.0.21 10 / 4
1100.0.20 10 / 4
1100.0.19 10 / 4
1100.0.18 10 / 4
1100.0.17 10 / 4
1100.0.16 10 / 4
1100.0.15 10 / 4
1100.0.14 10 / 4
1100.0.13 10 / 4
1100.0.12 10 / 4
1100.0.11 10 / 4
1100.0.10 10 / 4
1100.0.9 10 / 4
1100.0.8 10 / 4
1100.0.7 10 / 4
1100.0.6 10 / 4
1100.0.5 10 / 4
1100.0.4 10 / 4
1100.0.3 10 / 4
1100.0.2 10 / 4
1100.0.1 10 / 4
1100.0.0 10 / 4
1000.0.45 9 / 3
1000.0.44 9 / 3
1000.0.43 9 / 3
1000.0.42 9 / 3
1000.0.41 9 / 3
1000.0.40 9 / 3
1000.0.39 9 / 3
1000.0.38 9 / 3
1000.0.37 9 / 3
1000.0.36 9 / 3
1000.0.35 9 / 3
1000.0.34 9 / 3
1000.0.33 9 / 3
1000.0.32 9 / 3
1000.0.31 9 / 3
1000.0.30 9 / 3
1000.0.29 9 / 3
1000.0.28 9 / 3
1000.0.27 9 / 3
1000.0.26 9 / 3
1000.0.25 9 / 3
1000.0.24 9 / 3

v1100.0.28

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1100.0.27

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1100.0.26

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1100.0.25

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1100.0.24

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1100.0.23

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1100.0.22

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1000.0.45

1 finding
HIGH Provenance attestation missing — previous versions had it provenance

This version was published without provenance, but prior versions were published via CI/CD with attestations. This is a strong signal of a potential account compromise or unauthorized publish. The axios attack (March 2026) exhibited exactly this pattern.

v1000.0.40

1 finding
INFO Provenance attestation missing — previous versions had it provenance

[Accepted risk] This version was published without provenance, but prior versions were published via CI/CD with attestations. This is a strong signal of a potential account compromise or unauthorized publish. The axios attack (March 2026) exhibited exactly this pattern.