@polkadot-api/docgen
This package generates chain-specific documentation, based on metadata.
Supply chain provenance
Status for the latest visible version.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| phantom-deps | phantom-dep:tsup | AI (phantom-deps): tsup is a build tool referenced in build scripts; not a runtime import, stable false positive for this package. | ai | |
| dependencies | unvetted-dep:typedoc-plugin-extras | AI (dependencies): typedoc-plugin-extras is a documentation plugin used in a docgen tool; low risk for this package's purpose. | ai | |
| phantom-deps | phantom-dep:commander | AI (phantom-deps): commander is a declared runtime dep used via @commander-js/extra-typings; phantom-dep is a false positive for this package. | ai | |
| phantom-deps | phantom-dep:typescript | AI (phantom-deps): typescript is a build/config dependency; phantom-dep false positive for this tooling package. | ai | |
| phantom-deps | phantom-dep:@types/node | AI (phantom-deps): Framework-scoped type package; phantom-dep false positive for this package. | ai | |
| phantom-deps | phantom-dep:typedoc-plugin-extras | AI (phantom-deps): typedoc plugin loaded by convention via config, not direct import; stable false positive for this package. | ai |
Versions (showing 51 of 82)
| Version | Deps | Published |
|---|---|---|
| 0.3.15 | 8 / 0 | |
| 0.3.14 | 8 / 0 | |
| 0.3.9 | 8 / 0 | |
| 0.3.8 | 8 / 0 | |
| 0.3.7 | 8 / 0 | |
| 0.3.6 | 8 / 0 | |
| 0.3.5 | 8 / 0 | |
| 0.3.4 | 8 / 0 | |
| 0.3.3 | 8 / 0 | |
| 0.3.2 | 8 / 0 | |
| 0.3.1 | 8 / 0 | |
| 0.3.0 | 8 / 0 | |
| 0.2.44 | 9 / 0 | |
| 0.2.43 | 9 / 0 | |
| 0.2.42 | 9 / 0 | |
| 0.2.41 | 9 / 0 | |
| 0.2.40 | 9 / 0 | |
| 0.2.39 | 9 / 0 | |
| 0.2.38 | 9 / 0 | |
| 0.2.37 | 9 / 0 | |
| 0.2.36 | 9 / 0 | |
| 0.2.35 | 9 / 0 | |
| 0.2.34 | 9 / 0 | |
| 0.2.33 | 9 / 0 | |
| 0.2.32 | 9 / 0 | |
| 0.2.31 | 9 / 0 | |
| 0.2.30 | 9 / 0 | |
| 0.2.29 | 9 / 0 | |
| 0.2.28 | 9 / 0 | |
| 0.2.20 | 9 / 0 | |
| 0.2.19 | 9 / 0 | |
| 0.2.18 | 9 / 0 | |
| 0.2.17 | 9 / 0 | |
| 0.2.16 | 9 / 0 | |
| 0.2.15 | 9 / 0 | |
| 0.2.14 | 9 / 0 | |
| 0.2.13 | 9 / 0 | |
| 0.2.12 | 9 / 0 | |
| 0.2.11 | 9 / 0 | |
| 0.2.10 | 9 / 0 | |
| 0.2.9 | 9 / 0 | |
| 0.2.8 | 9 / 0 | |
| 0.2.7 | 9 / 0 | |
| 0.2.6 | 9 / 0 | |
| 0.2.5 | 9 / 0 | |
| 0.2.4 | 9 / 0 | |
| 0.2.3 | 9 / 0 | |
| 0.2.2 | 9 / 0 | |
| 0.2.1 | 9 / 0 | |
| 0.2.0 | 9 / 0 | |
| 0.1.23 | 9 / 0 |
v0.3.15
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.3.14
2 findingsPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
This version was published by a different npm account (GitHub Actions) than the most recent previously approved version (voliva) on 2026-07-20, but it carries Sigstore provenance attestation. This means the package moved to a trusted publisher (CI/CD with OIDC, e.g. GitHub Actions) — a supply-chain integrity improvement, not a compromise, since a stolen npm token cannot forge provenance bound to the source repository. Recorded as INFO for audit trail.