← Home

@quatrain/storage-supabase

npm Repository Homepage

Storage adapter for Supabase Storage

19
Versions
AGPL-3.0-only
License
No
Install Scripts
Verified
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures No source commit

Maintainers

crapougnaxelliottlepine

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
semgrep semgrep:base64-decode AI (semgrep): Decodes downloaded file content into a buffer for streaming; no exfiltration or code execution path. ai
phantom-deps phantom-dep:@quatrain/core AI (phantom-deps): Same-org monorepo dependency; phantom-dep heuristic is a false positive here. ai
phantom-deps phantom-dep:@supabase/supabase-js AI (phantom-deps): Referenced in config files; phantom-dep heuristic is a false positive for this usage pattern. ai

Versions (showing 19 of 19)

Version Deps Published
1.1.30 4 / 9
1.1.26 4 / 9
1.1.25 4 / 9
1.1.24 4 / 9
1.1.23 4 / 9
1.1.22 4 / 9
1.1.21 4 / 9
1.1.20 4 / 9
1.1.19 4 / 9
1.1.18 4 / 9
1.1.17 4 / 9
1.1.16 4 / 9
1.1.15 4 / 9
1.1.14 4 / 9
1.1.13 4 / 9
1.1.12 4 / 9
1.1.11 3 / 9
1.1.7 3 / 9
1.1.6 3 / 9

v1.1.12

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.1.11

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.1.7

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.1.6

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.