@red-hat-developer-hub/backstage-plugin-orchestrator
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| publish-pattern | new-deps-added | AI (publish-pattern): @material-ui/lab is a well-established MUI package; addition is consistent with existing @material-ui/core dependency. | ai | |
| npm-metadata | no-description | AI (npm-metadata): Org-scoped Backstage plugin; description gaps are stable across this package's versions. | ai | |
| provenance | no-provenance | AI (provenance): Red Hat org package; provenance absence is consistent across versions and not a takeover signal. | ai | |
| bogus-package | bogus-package | AI (bogus-package): Backstage plugin with keywords, repo, and proper exports; bogus-package signals are false positives for this package type. | ai | |
| phantom-deps | phantom-dep:@kie-tools-core/editor | AI (phantom-deps): Config-referenced dependency; stable pattern for Backstage plugins. | ai | |
| phantom-deps | phantom-dep:react-json-view | AI (phantom-deps): Config-file reference; stable pattern for Backstage plugins. | ai | |
| phantom-deps | phantom-dep:@backstage/types | AI (phantom-deps): Type-only dependency common in Backstage plugins; phantom-dep heuristic false positive. | ai | |
| dependencies | unvetted-dep:@red-hat-developer-hub/backstage-plugin-orchestrator-common | AI (dependencies): First-party sibling package in the same Red Hat org; expected dependency for this plugin family. | ai | |
| phantom-deps | phantom-dep:vscode-languageserver-types | AI (phantom-deps): Type-only dependency for JSON schema support; phantom-dep false positive. | ai | |
| dependencies | unvetted-dep:@red-hat-developer-hub/backstage-plugin-orchestrator-form-api | AI (dependencies): First-party sibling package in the same Red Hat org; expected dependency for this plugin family. | ai | |
| dependencies | unvetted-dep:@red-hat-developer-hub/backstage-plugin-orchestrator-form-react | AI (dependencies): First-party sibling package in the same Red Hat org; expected dependency for this plugin family. | ai | |
| dependencies | unvetted-dep:@material-ui/lab | AI (dependencies): Well-known MUI v4 lab package; stable false positive for Backstage plugins using MUI v4. | ai | |
| phantom-deps | phantom-dep:@red-hat-developer-hub/backstage-plugin-orchestrator-form-api | AI (phantom-deps): Used as a type/API boundary dep; phantom-dep heuristic fires on indirect usage patterns common in plugin APIs. | ai | |
| phantom-deps | phantom-dep:json-schema | AI (phantom-deps): Referenced in config/type files; phantom-dep false positive for type-level usage. | ai |
Versions (showing 36 of 36)
| Version | Deps | Published |
|---|---|---|
| 5.7.11 | 25 / 25 | |
| 5.7.8 | 25 / 25 | |
| 5.7.7 | 25 / 25 | |
| 5.7.6 | 25 / 25 | |
| 5.7.5 | 25 / 25 | |
| 5.7.3 | 24 / 25 | |
| 5.7.2 | 24 / 25 | |
| 5.7.1 | 24 / 25 | |
| 5.7.0 | 24 / 25 | |
| 5.6.0 | 24 / 25 | |
| 5.5.2 | 21 / 19 | |
| 5.5.1 | 21 / 19 | |
| 5.5.0 | 21 / 19 | |
| 5.4.6 | 22 / 19 | |
| 5.4.5 | 22 / 19 | |
| 5.4.4 | 22 / 19 | |
| 5.4.3 | 22 / 19 | |
| 5.4.2 | 21 / 19 | |
| 5.4.1 | 21 / 19 | |
| 5.4.0 | 21 / 19 | |
| 5.3.1 | 21 / 19 | |
| 5.3.0 | 22 / 15 | |
| 5.2.1 | 23 / 15 | |
| 5.2.0 | 23 / 15 | |
| 5.1.1 | 23 / 15 | |
| 5.1.0 | 23 / 15 | |
| 5.0.9 | 23 / 15 | |
| 5.0.8 | 23 / 15 | |
| 5.0.7 | 23 / 15 | |
| 5.0.6 | 23 / 15 | |
| 5.0.5 | 25 / 15 | |
| 5.0.4 | 25 / 15 | |
| 5.0.3 | 25 / 15 | |
| 5.0.2 | 25 / 15 | |
| 5.0.1 | 24 / 15 | |
| 5.0.0 | 24 / 15 |
v5.7.11
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.7.8
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.7.7
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.7.6
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.7.5
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.7.3
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.7.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.7.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.7.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.6.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.5.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.5.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.5.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.4.6
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.4.5
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.4.4
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.4.3
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.4.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.4.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.4.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.3.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.3.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.2.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.2.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.1.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.1.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.0.9
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.0.8
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.0.7
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.0.6
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.0.5
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.0.4
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.0.3
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.0.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.0.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.0.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.