@premai/pcci-sdk-ts
End-to-end encrypted OpenAI-compatible client with file upload and tools support, using XWing (ML-KEM768 + X25519) hybrid post-quantum encryption.
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| dependencies | unvetted-dep:@premAI-io/prem-rs | AI (dependencies): First-party dependency from the same premai-io org; consistent with SDK purpose across versions. | ai | |
| provenance | no-provenance | AI (provenance): Published via GitHub Actions CI; absence of Sigstore attestation is common and not a risk indicator for this package. | ai | |
| phantom-deps | phantom-dep:typescript | AI (phantom-deps): typescript is a declared runtime dep used by the build toolchain; phantom-dep heuristic is a false positive here. | ai | |
| phantom-deps | phantom-dep:@noble/curves | AI (phantom-deps): @noble/curves is a declared runtime dep; phantom-dep heuristic fires due to indirect usage pattern, not a real issue. | ai |
Versions (showing 11 of 11)
| Version | Deps | Published |
|---|---|---|
| 1.0.29 | 13 / 6 | |
| 1.0.28 | 13 / 6 | |
| 1.0.27 | 13 / 6 | |
| 1.0.26 | 13 / 6 | |
| 1.0.25 | 13 / 6 | |
| 1.0.24 | 13 / 6 | |
| 1.0.23 | 13 / 6 | |
| 1.0.22 | 13 / 6 | |
| 1.0.21 | 13 / 6 | |
| 1.0.20 | 13 / 6 | |
| 1.0.18 | 13 / 6 |
v1.0.28
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.27
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.26
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.25
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.24
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.23
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.22
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.21
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.20
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.18
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.