@quintype/seo
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| semgrep | semgrep:dynamic-require | AI (semgrep): Fires in docs-src/publish.js (jsdoc tooling), not in distributed runtime code. | ai | |
| phantom-deps | phantom-dep:date-fns | AI (phantom-deps): date-fns is a declared runtime dependency; phantom-dep heuristic is a false positive here. | ai |
Versions (showing 19 of 19)
| Version | Deps | Published |
|---|---|---|
| 1.53.1 | 3 / 31 | |
| 1.53.0 | 3 / 31 | |
| 1.52.2 | 3 / 31 | |
| 1.51.0 | 3 / 31 | |
| 1.50.3 | 3 / 31 | |
| 1.50.2 | 3 / 31 | |
| 1.50.1 | 3 / 31 | |
| 1.50.0 | 3 / 31 | |
| 1.49.2 | 3 / 31 | |
| 1.49.1 | 3 / 31 | |
| 1.49.0 | 3 / 31 | |
| 1.48.1 | 3 / 31 | |
| 1.48.0 | 3 / 31 | |
| 1.47.0 | 3 / 31 | |
| 1.46.5 | 3 / 31 | |
| 1.46.4 | 3 / 31 | |
| 1.46.3 | 3 / 31 | |
| 1.46.2 | 3 / 31 | |
| 1.46.1 | 3 / 31 |
v1.53.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.53.0
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (veena.yemmiganur) than the most recent previously approved version (mohammedshoaib) on 2026-07-02, but veena.yemmiganur is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v1.49.0
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (reena07111996) than the most recent previously approved version (vishwanath.reddy) on 2025-04-24, but reena07111996 is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v1.48.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.48.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.47.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.46.5
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (vishwanath.reddy) than the most recent previously approved version (arunabhthakur94) on 2024-09-25, but vishwanath.reddy is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v1.46.4
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (arunabhthakur94) than the most recent previously approved version (shraddha_kesari) on 2024-08-14, but arunabhthakur94 is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v1.46.3
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (shraddha_kesari) than the most recent previously approved version (arunabhthakur94) on 2024-07-17, but shraddha_kesari is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v1.46.2
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (shraddha_kesari) than the most recent previously approved version (arunabhthakur94) on 2024-06-12, but shraddha_kesari is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v1.46.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.