@qrvey/qrvey-smart-analyzer
Smart Analyzer unleashes the power of artificial intelligence (AI) to acquire new insights into your data. This feature establishes a link between ChatGPT and the data in your chart, enabling you to ask ChatGPT questions in natural language about your dat
10
Versions
MIT
License
No
Install Scripts
Missing
Provenance
Supply chain provenance
Status for the latest visible version.
No SLSA provenance
npm registry signatures
gitHead linked
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
amit.bhatnagarricardo.madridjmsosaemirpolosandresbc86juandavidleg1hugo.tilanomario.vascojose.gonzalez.qrveyrafamedranoqrvey-jespineldaniel.henriquezeveracostaqrveyandresbetinqrveyneox10
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| phantom-deps | phantom-dep:@qrvey/utils | AI (phantom-deps): Same-org scoped dep; likely transitive or config-referenced in build setup. | ai | |
| phantom-deps | phantom-dep:copy-webpack-plugin | AI (phantom-deps): Webpack plugin referenced in build config; not directly imported in source. | ai | |
| phantom-deps | phantom-dep:@qrvey/websocket-client | AI (phantom-deps): Same-org scoped dep; likely transitive or config-referenced in build setup. | ai | |
| phantom-deps | phantom-dep:lodash | AI (phantom-deps): lodash declared as runtime dep for bundling; phantom-dep heuristic fires on build-tool usage patterns. | ai | |
| phantom-deps | phantom-dep:marked | AI (phantom-deps): marked declared as runtime dep for bundling; same build-tool false-positive pattern. | ai | |
| phantom-deps | phantom-dep:browser-sync-client | AI (phantom-deps): browser-sync-client is a declared dep used indirectly via browser-sync; stable false positive for this package. | ai |
Versions (showing 10 of 10)
| Version | Deps | Published |
|---|---|---|
| 2.0.9 | 6 / 3 | |
| 2.0.8 | 6 / 3 | |
| 2.0.7 | 5 / 4 | |
| 2.0.6 | 5 / 4 | |
| 2.0.5 | 6 / 3 | |
| 2.0.4 | 6 / 4 | |
| 2.0.3 | 6 / 3 | |
| 2.0.2 | 5 / 3 | |
| 2.0.1 | 5 / 3 | |
| 2.0.0 | 5 / 3 |
v2.0.0
1 finding
LOW
No provenance attestation
provenance
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.