@quenty/inputkeymaputils
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| npm-metadata | url-dep:@quentystudios/jest-lua | AI (npm-metadata): Test/dev dependency from same org; git URL is a known pattern for this publisher's test tooling. | ai | |
| provenance | no-provenance | AI (provenance): Large Roblox monorepo; provenance not used across the entire @quenty scope. | ai | |
| dependencies | unvetted-dep:@quenty/rx | AI (dependencies): Same-org monorepo dependency; stable pattern across all Quenty/NevermoreEngine packages. | ai | |
| dependencies | unvetted-dep:@quentystudios/jest-lua | AI (dependencies): Same-org test dependency used across NevermoreEngine packages; not a runtime risk. | ai | |
| phantom-deps | phantom-dep:@quenty/nevermore-test-runner | AI (phantom-deps): Same-org test runner; phantom-dep pattern is stable for this monorepo package. | ai | |
| phantom-deps | phantom-dep:@quenty/loader | AI (phantom-deps): Lua package; not imported as JS module. Expected pattern for this Roblox/Lua monorepo. | ai | |
| phantom-deps | phantom-dep:@quenty/signal | AI (phantom-deps): Lua package; not imported as JS module. Expected pattern for this Roblox/Lua monorepo. | ai | |
| phantom-deps | phantom-dep:@quenty/string | AI (phantom-deps): Lua package; not imported as JS module. Expected pattern for this Roblox/Lua monorepo. | ai | |
| phantom-deps | phantom-dep:@quenty/ducktype | AI (phantom-deps): Lua package; not imported as JS module. Expected pattern for this Roblox/Lua monorepo. | ai | |
| phantom-deps | phantom-dep:@quenty/enumutils | AI (phantom-deps): Lua package; not imported as JS module. Expected pattern for this Roblox/Lua monorepo. | ai | |
| phantom-deps | phantom-dep:@quenty/inputmode | AI (phantom-deps): Lua package; not imported as JS module. Expected pattern for this Roblox/Lua monorepo. | ai | |
| phantom-deps | phantom-dep:@quenty/baseobject | AI (phantom-deps): Lua package; not imported as JS module. Expected pattern for this Roblox/Lua monorepo. | ai | |
| install-scripts | install-script:preinstall | AI (install-scripts): npx only-allow pnpm is a standard package manager enforcement script, not malicious. Stable for this monorepo. | ai | |
| phantom-deps | phantom-dep:@quenty/statestack | AI (phantom-deps): Lua package; not imported as JS module. Expected pattern for this Roblox/Lua monorepo. | ai | |
| phantom-deps | phantom-dep:@quenty/valueobject | AI (phantom-deps): Lua package; not imported as JS module. Expected pattern for this Roblox/Lua monorepo. | ai | |
| phantom-deps | phantom-dep:@quenty/pseudolocalize | AI (phantom-deps): Lua package; not imported as JS module. Expected pattern for this Roblox/Lua monorepo. | ai | |
| phantom-deps | phantom-dep:@quenty/valuebaseutils | AI (phantom-deps): Lua package; not imported as JS module. Expected pattern for this Roblox/Lua monorepo. | ai | |
| phantom-deps | phantom-dep:@quentystudios/jest-lua | AI (phantom-deps): Lua test runner; referenced in config files, not JS imports. Expected for this monorepo. | ai | |
| phantom-deps | phantom-dep:@quenty/clienttranslator | AI (phantom-deps): Lua package; not imported as JS module. Expected pattern for this Roblox/Lua monorepo. | ai | |
| phantom-deps | phantom-dep:@quenty/observablecollection | AI (phantom-deps): Lua package; not imported as JS module. Expected pattern for this Roblox/Lua monorepo. | ai | |
| phantom-deps | phantom-dep:@quenty/servicebag | AI (phantom-deps): Lua package; not imported as JS module. Expected pattern for this Roblox/Lua monorepo. | ai | |
| phantom-deps | phantom-dep:@quenty/rx | AI (phantom-deps): Lua package; not imported as JS module. Expected pattern for this Roblox/Lua monorepo. | ai | |
| phantom-deps | phantom-dep:@quenty/brio | AI (phantom-deps): Lua package; not imported as JS module. Expected pattern for this Roblox/Lua monorepo. | ai | |
| phantom-deps | phantom-dep:@quenty/maid | AI (phantom-deps): Lua package; not imported as JS module. Expected pattern for this Roblox/Lua monorepo. | ai | |
| phantom-deps | phantom-dep:@quenty/table | AI (phantom-deps): Lua package; not imported as JS module. Expected pattern for this Roblox/Lua monorepo. | ai |
Versions (showing 44 of 44)
| Version | Deps | Published |
|---|---|---|
| 14.41.2 | 20 / 0 | |
| 14.41.0 | 20 / 0 | |
| 14.40.0 | 19 / 0 | |
| 14.38.0 | 19 / 0 | |
| 14.31.1 | 17 / 0 | |
| 14.29.1 | 17 / 0 | |
| 14.28.0 | 17 / 0 | |
| 14.25.0 | 17 / 0 | |
| 14.23.3 | 17 / 0 | |
| 14.23.2 | 17 / 0 | |
| 14.23.0 | 17 / 0 | |
| 14.22.4 | 17 / 0 | |
| 14.22.3 | 17 / 0 | |
| 14.22.2 | 17 / 0 | |
| 14.22.1 | 17 / 0 | |
| 14.22.0 | 17 / 0 | |
| 14.21.1 | 17 / 0 | |
| 14.21.0 | 17 / 0 | |
| 14.20.0 | 17 / 0 | |
| 14.19.0 | 17 / 0 | |
| 14.18.0 | 17 / 0 | |
| 14.17.0 | 17 / 0 | |
| 14.16.0 | 17 / 0 | |
| 14.15.0 | 17 / 0 | |
| 14.14.1 | 17 / 0 | |
| 14.14.0 | 17 / 0 | |
| 14.13.0 | 17 / 0 | |
| 14.12.2 | 17 / 0 | |
| 14.12.1 | 17 / 0 | |
| 14.12.0 | 17 / 0 | |
| 14.11.1 | 17 / 0 | |
| 14.11.0 | 17 / 0 | |
| 14.10.0 | 17 / 0 | |
| 14.9.0 | 17 / 0 | |
| 14.8.2 | 17 / 0 | |
| 14.8.1 | 17 / 0 | |
| 14.8.0 | 17 / 0 | |
| 14.7.0 | 17 / 0 | |
| 14.6.2 | 17 / 0 | |
| 14.6.1 | 17 / 0 | |
| 14.6.0 | 17 / 0 | |
| 14.5.0 | 17 / 0 | |
| 14.4.0 | 17 / 0 | |
| 14.3.0 | 17 / 0 |
v14.23.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v14.23.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v14.23.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v14.22.4
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v14.22.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v14.22.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v14.22.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v14.22.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v14.21.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v14.21.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v14.20.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v14.19.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v14.18.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v14.17.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v14.16.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v14.15.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v14.14.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v14.14.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v14.13.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v14.12.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v14.12.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v14.12.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v14.11.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v14.11.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v14.10.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v14.9.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v14.8.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v14.8.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v14.8.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v14.7.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v14.6.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v14.6.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v14.6.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v14.5.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v14.4.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v14.3.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.