@polymer/polymer
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| provenance | missing-githead | AI (provenance): Manual publish by known maintainer of a canonical package; no source-integrity concern. | ai | |
| maintainer-change | maintainer-added | AI (maintainer-change): Org-level maintainer rotation on a long-established first-party package; no behavior change. | ai | |
| publish-pattern | dormant-publish | AI (publish-pattern): Dormancy consistent with slow-moving mature library; diff shows no material change. | ai | |
| semgrep | semgrep:dynamic-require | AI (semgrep): Fires inside vendored mocha test runner, not package code. | ai | |
| semgrep | semgrep:child-process-import | AI (semgrep): Vendored mocha CLI code, not part of shipped runtime behavior. | ai | |
| semgrep | semgrep:new-function-constructor | AI (semgrep): Vendored stacky env-detection utility, benign pattern. | ai | |
| semgrep | semgrep:eval-usage | AI (semgrep): Vendored sinon fake-timers library, standard eval use in test lib. | ai | |
| vendored-integrity | unresolved-vendored-tree:bower_components/mocha | AI (vendored-integrity): Bundled test tooling from repo, not an implant; stable across Polymer versions. | ai | |
| vendored-integrity | unresolved-vendored-tree:bower_components/polymer | AI (vendored-integrity): Self-referential vendored copy from demo/build tooling, benign. | ai | |
| dependencies | unvetted-dep:@webcomponents/shadycss | AI (dependencies): @webcomponents/shadycss is the official ShadyCSS polyfill from the Polymer/Google project — a legitimate and expected dependency for @polymer/polymer across all versions. | ai |
Versions (showing 15 of 15)
| Version | Deps | Published |
|---|---|---|
| 3.5.2 | 1 / 26 | |
| 3.5.1 | 1 / 26 | |
| 3.5.0 | 1 / 26 | |
| 3.4.1 | 1 / 26 | |
| 3.4.0 | 1 / 27 | |
| 3.3.1 | 1 / 27 | |
| 3.3.0 | 1 / 27 | |
| 3.2.0 | 1 / 27 | |
| 3.1.0 | 1 / 27 | |
| 3.0.5 | 1 / 27 | |
| 3.0.4 | 1 / 27 | |
| 3.0.3 | 1 / 27 | |
| 3.0.2 | 1 / 27 | |
| 3.0.1 | 1 / 27 | |
| 3.0.0 | 1 / 27 |
v3.5.1
3 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: bicknellr.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (bicknellr) than the most recent previously approved version (azakus) on 2022-06-03, but bicknellr is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v3.5.0
3 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: bicknellr.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (bicknellr) than the most recent previously approved version (azakus) on 2022-05-18, but bicknellr is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v3.4.1
3 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: polymer-devs.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (polymer-devs) than the most recent previously approved version (azakus) on 2020-04-30, but polymer-devs is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v3.4.0
3 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: polymer-devs.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (polymer-devs) than the most recent previously approved version (azakus) on 2020-04-27, but polymer-devs is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v3.3.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.3.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.2.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.1.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.0.5
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.0.4
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.0.3
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v3.0.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v3.0.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v3.0.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.