@reltio/graph
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | encoded-string-file:bundle.js | AI (source-diff): bundle.js is a standard webpack bundle; long strings are MUI icon require lists, not obfuscated payloads. | ai | |
| npm-metadata | no-description | AI (npm-metadata): Consistent pattern across 1353 versions of this org-internal package. | ai | |
| provenance | no-provenance | AI (provenance): Org-internal package; no provenance is consistent across all versions. | ai | |
| bogus-package | bogus-package | AI (bogus-package): Internal enterprise module; sparse metadata is consistent across all 1353 versions of this org's packages. | ai | |
| phantom-deps | phantom-dep:graphology-layout | AI (phantom-deps): Graph layout lib; referenced in config, stable FP. | ai | |
| phantom-deps | phantom-dep:graphology-operators | AI (phantom-deps): Graph operators lib; referenced in config, stable FP. | ai | |
| phantom-deps | phantom-dep:graphology-shortest-path | AI (phantom-deps): Graph algorithm lib; referenced in config, stable FP. | ai | |
| phantom-deps | phantom-dep:sigma | AI (phantom-deps): Graph visualization lib; likely re-exported or used via config/peer, not directly imported. | ai | |
| phantom-deps | phantom-dep:@reltio/profile | AI (phantom-deps): Same org scope; stable FP for internal monorepo-style package. | ai | |
| phantom-deps | phantom-dep:@reltio/components | AI (phantom-deps): Same org scope; stable FP for internal monorepo-style package. | ai | |
| phantom-deps | phantom-dep:@reltio/mdm-module | AI (phantom-deps): Same org scope; stable FP for internal monorepo-style package. | ai | |
| phantom-deps | phantom-dep:@reltio/mdm-sdk | AI (phantom-deps): Same org scope; stable FP for internal monorepo-style package. | ai | |
| phantom-deps | phantom-dep:graphology | AI (phantom-deps): Core graph lib; referenced in config, stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:graphology-types | AI (phantom-deps): Type-only dep; not directly imported but used in config/types. | ai | |
| phantom-deps | phantom-dep:@react-sigma/core | AI (phantom-deps): Sigma React wrapper; referenced in config, stable FP for this package. | ai |
Versions (showing 51 of 319)
| Version | Deps | Published |
|---|---|---|
| 1.4.2354 | 11 / 0 | |
| 1.4.2353 | 11 / 0 | |
| 1.4.2351 | 11 / 0 | |
| 1.4.2350 | 11 / 0 | |
| 1.4.2349 | 11 / 0 | |
| 1.4.2348 | 11 / 0 | |
| 1.4.2347 | 11 / 0 | |
| 1.4.2346 | 11 / 0 | |
| 1.4.2345 | 11 / 0 | |
| 1.4.2344 | 11 / 0 | |
| 1.4.2343 | 11 / 0 | |
| 1.4.2342 | 11 / 0 | |
| 1.4.2341 | 11 / 0 | |
| 1.4.2340 | 11 / 0 | |
| 1.4.2339 | 11 / 0 | |
| 1.4.2338 | 11 / 0 | |
| 1.4.2337 | 11 / 0 | |
| 1.4.2335 | 11 / 0 | |
| 1.4.2334 | 11 / 0 | |
| 1.4.2333 | 11 / 0 | |
| 1.4.2332 | 11 / 0 | |
| 1.4.2331 | 11 / 0 | |
| 1.4.2330 | 11 / 0 | |
| 1.4.2329 | 11 / 0 | |
| 1.4.2328 | 11 / 0 | |
| 1.4.2323 | 11 / 0 | |
| 1.4.2322 | 11 / 0 | |
| 1.4.2319 | 11 / 0 | |
| 1.4.2317 | 11 / 0 | |
| 1.4.2316 | 11 / 0 | |
| 1.4.2315 | 11 / 0 | |
| 1.4.2314 | 11 / 0 | |
| 1.4.2313 | 11 / 0 | |
| 1.4.2312 | 11 / 0 | |
| 1.4.2311 | 11 / 0 | |
| 1.4.2310 | 11 / 0 | |
| 1.4.2309 | 11 / 0 | |
| 1.4.2308 | 11 / 0 | |
| 1.4.2307 | 11 / 0 | |
| 1.4.2306 | 11 / 0 | |
| 1.4.2304 | 11 / 0 | |
| 1.4.2303 | 11 / 0 | |
| 1.4.2302 | 11 / 0 | |
| 1.4.2301 | 11 / 0 | |
| 1.4.2298 | 11 / 0 | |
| 1.4.2295 | 11 / 0 | |
| 1.4.2294 | 11 / 0 | |
| 1.4.2293 | 11 / 0 | |
| 1.4.2288 | 11 / 0 | |
| 1.4.2283 | 11 / 0 | |
| 1.4.2281 | 11 / 0 |
v1.4.2354
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.4.2353
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.4.2351
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.4.2350
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.4.2349
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.4.2348
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.4.2347
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.4.2346
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.4.2345
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.4.2344
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.4.2343
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.