← Home

@react-native-firebase/app

npm Repository Homepage
17
Versions
—
License
No
Install Scripts
Verified
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures gitHead linked

Maintainers

salakarehesprusticmanmikehardy

Keywords

reactadmobauthconfigdigitsfabricfunctionsphone-authsmsfirestorecloud-firestoredatastoreremote-configtransactionsreact-nativereact-native-firebasefirebasefcmapngcmanalyticsmessagingdatabaseandroidioscrashfirestackperformancefirestoredynamic-linkscrashlytics

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
provenance publisher-changed AI (provenance): Transition to GitHub Actions CI/CD publishing with SLSA provenance; expected for this org. ai
typosquat typosquat.levenshtein:hapi AI (typosquat): Scoped package @react-native-firebase/app cannot typosquat hapi; Levenshtein match is meaningless here. ai
typosquat typosquat.levenshtein:pg AI (typosquat): Scoped package @react-native-firebase/app cannot typosquat pg; false positive. ai
typosquat typosquat.levenshtein:yup AI (typosquat): Scoped package @react-native-firebase/app cannot typosquat yup; false positive. ai
typosquat typosquat.levenshtein:ajv AI (typosquat): Scoped package @react-native-firebase/app cannot typosquat ajv; false positive. ai
semgrep semgrep:api-obfuscation-reflect AI (semgrep): Reflect.get() inside a Proxy constructor trap is idiomatic JS; not obfuscation. ai

Versions (showing 17 of 17)

Version Deps Published
25.1.0 1 / 3
25.0.1 1 / 3
25.0.0 1 / 3
24.1.1 1 / 3
24.1.0 1 / 3
24.0.0 1 / 3
23.8.8 1 / 3
23.8.6 1 / 3
23.8.5 1 / 3
23.8.4 1 / 3
23.8.3 1 / 3
23.8.2 1 / 3
23.8.1 1 / 3
23.8.0 1 / 3
23.7.0 1 / 2
23.6.0 1 / 2
23.5.0 1 / 2

v25.1.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.