@qrvey/qrvey-smart-analyzer
Smart Analyzer unleashes the power of artificial intelligence (AI) to acquire new insights into your data. This feature establishes a link between ChatGPT and the data in your chart, enabling you to ask ChatGPT questions in natural language about your dat
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| phantom-deps | phantom-dep:@qrvey/utils | AI (phantom-deps): Same-org scoped dep; likely transitive or config-referenced in build setup. | ai | |
| phantom-deps | phantom-dep:copy-webpack-plugin | AI (phantom-deps): Webpack plugin referenced in build config; not directly imported in source. | ai | |
| phantom-deps | phantom-dep:@qrvey/websocket-client | AI (phantom-deps): Same-org scoped dep; likely transitive or config-referenced in build setup. | ai | |
| phantom-deps | phantom-dep:lodash | AI (phantom-deps): lodash declared as runtime dep for bundling; phantom-dep heuristic fires on build-tool usage patterns. | ai | |
| phantom-deps | phantom-dep:marked | AI (phantom-deps): marked declared as runtime dep for bundling; same build-tool false-positive pattern. | ai | |
| phantom-deps | phantom-dep:browser-sync-client | AI (phantom-deps): browser-sync-client is a declared dep used indirectly via browser-sync; stable false positive for this package. | ai |
Versions (showing 9 of 9)
| Version | Deps | Published |
|---|---|---|
| 2.0.9 | 6 / 3 | |
| 2.0.8 | 6 / 3 | |
| 2.0.7 | 5 / 4 | |
| 2.0.6 | 5 / 4 | |
| 2.0.5 | 6 / 3 | |
| 2.0.4 | 6 / 4 | |
| 2.0.3 | 6 / 3 | |
| 2.0.2 | 5 / 3 | |
| 2.0.1 | 5 / 3 |
v2.0.9
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v2.0.8
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v2.0.7
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v2.0.6
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v2.0.5
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v2.0.4
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v2.0.3
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v2.0.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v2.0.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.