@reltio/data-model
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| dependencies | unvetted-dep:@reltio/mdm-sdk | AI (dependencies): Same-org scoped dependency (@reltio); expected internal dependency pattern for this package family. | ai | |
| dependencies | unvetted-dep:@reltio/mdm-module | AI (dependencies): Same-org scoped dependency (@reltio); expected internal dependency pattern for this package family. | ai | |
| phantom-deps | phantom-dep:@reltio/mdm-sdk | AI (phantom-deps): Same-org dep; phantom-dep heuristic unreliable for bundled packages. | ai | |
| phantom-deps | phantom-dep:@reltio/components | AI (phantom-deps): Same-org dep; phantom-dep heuristic unreliable for bundled packages. | ai | |
| semgrep | semgrep:new-function-constructor | AI (semgrep): Fires in bundled output (bundle.js); standard webpack/rollup artifact for this UI component package. | ai | |
| phantom-deps | phantom-dep:graphology | AI (phantom-deps): Likely bundled into bundle.js output; phantom-dep heuristic unreliable for bundled packages. | ai | |
| phantom-deps | phantom-dep:@reltio/mdm-module | AI (phantom-deps): Same-org dep; phantom-dep heuristic unreliable for bundled packages. | ai | |
| bogus-package | bogus-package | AI (bogus-package): 507-version org-scoped package; missing metadata is a style issue, not a spam/malware indicator. | ai |
Versions (showing 51 of 481)
| Version | Deps | Published |
|---|---|---|
| 1.4.2371 | 4 / 0 | |
| 1.4.2370 | 4 / 0 | |
| 1.4.2368 | 4 / 0 | |
| 1.4.2367 | 4 / 0 | |
| 1.4.2366 | 4 / 0 | |
| 1.4.2365 | 4 / 0 | |
| 1.4.2364 | 4 / 0 | |
| 1.4.2363 | 4 / 0 | |
| 1.4.2362 | 4 / 0 | |
| 1.4.2361 | 4 / 0 | |
| 1.4.2360 | 4 / 0 | |
| 1.4.2359 | 4 / 0 | |
| 1.4.2358 | 4 / 0 | |
| 1.4.2357 | 4 / 0 | |
| 1.4.2356 | 4 / 0 | |
| 1.4.2355 | 4 / 0 | |
| 1.4.2353 | 4 / 0 | |
| 1.4.2352 | 4 / 0 | |
| 1.4.2351 | 4 / 0 | |
| 1.4.2350 | 4 / 0 | |
| 1.4.2349 | 4 / 0 | |
| 1.4.2348 | 4 / 0 | |
| 1.4.2347 | 4 / 0 | |
| 1.4.2346 | 4 / 0 | |
| 1.4.2345 | 4 / 0 | |
| 1.4.2344 | 4 / 0 | |
| 1.4.2343 | 4 / 0 | |
| 1.4.2342 | 4 / 0 | |
| 1.4.2341 | 4 / 0 | |
| 1.4.2340 | 4 / 0 | |
| 1.4.2339 | 4 / 0 | |
| 1.4.2338 | 4 / 0 | |
| 1.4.2337 | 4 / 0 | |
| 1.4.2336 | 4 / 0 | |
| 1.4.2335 | 4 / 0 | |
| 1.4.2334 | 4 / 0 | |
| 1.4.2333 | 4 / 0 | |
| 1.4.2332 | 4 / 0 | |
| 1.4.2331 | 4 / 0 | |
| 1.4.2330 | 4 / 0 | |
| 1.4.2329 | 4 / 0 | |
| 1.4.2328 | 4 / 0 | |
| 1.4.2327 | 4 / 0 | |
| 1.4.2326 | 4 / 0 | |
| 1.4.2325 | 4 / 0 | |
| 1.4.2324 | 4 / 0 | |
| 1.4.2323 | 4 / 0 | |
| 1.4.2322 | 4 / 0 | |
| 1.4.2321 | 4 / 0 | |
| 1.4.2320 | 4 / 0 | |
| 1.4.2319 | 4 / 0 |
v1.4.2371
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.4.2370
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.4.2368
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.4.2367
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.4.2366
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.4.2365
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.4.2364
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.4.2363
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.4.2362
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.4.2361
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.4.2360
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.