@reltio/hierarchy
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| provenance | no-provenance | AI (provenance): Internal Reltio package; no provenance is consistent across all versions in this org. | ai | |
| npm-metadata | no-description | AI (npm-metadata): Stable internal org package; missing description is a consistent pattern across versions, not a malware signal. | ai | |
| semgrep | semgrep:new-function-constructor | AI (semgrep): Fires in webpack bundle output; standard pattern for this org's UI packages across many versions. | ai | |
| dependencies | unvetted-dep:@reltio/mdm-sdk | AI (dependencies): Same org scope (@reltio); internal dependency consistent with this package's ecosystem. | ai | |
| dependencies | unvetted-dep:@reltio/mdm-module | AI (dependencies): Same org scope (@reltio); internal dependency consistent with this package's ecosystem. | ai | |
| bogus-package | bogus-package | AI (bogus-package): Internal enterprise component; missing metadata is expected, not a spam/malware indicator given 100-version history. | ai | |
| phantom-deps | phantom-dep:@reltio/mdm-sdk | AI (phantom-deps): Same org scope; phantom-dep heuristic unreliable for bundled internal packages. | ai | |
| phantom-deps | phantom-dep:@reltio/mdm-module | AI (phantom-deps): Same org scope; consistent with bundled internal module pattern. | ai | |
| phantom-deps | phantom-dep:@reltio/components | AI (phantom-deps): Same org scope; consistent with bundled internal component library pattern. | ai |
Versions (showing 51 of 128)
| Version | Deps | Published |
|---|---|---|
| 1.4.133 | 3 / 0 | |
| 1.4.132 | 3 / 0 | |
| 1.4.131 | 3 / 0 | |
| 1.4.130 | 3 / 0 | |
| 1.4.129 | 3 / 0 | |
| 1.4.128 | 3 / 0 | |
| 1.4.127 | 3 / 0 | |
| 1.4.126 | 3 / 0 | |
| 1.4.125 | 3 / 0 | |
| 1.4.124 | 3 / 0 | |
| 1.4.123 | 3 / 0 | |
| 1.4.122 | 3 / 0 | |
| 1.4.121 | 3 / 0 | |
| 1.4.119 | 3 / 0 | |
| 1.4.118 | 3 / 0 | |
| 1.4.117 | 3 / 0 | |
| 1.4.116 | 3 / 0 | |
| 1.4.115 | 3 / 0 | |
| 1.4.114 | 3 / 0 | |
| 1.4.113 | 3 / 0 | |
| 1.4.112 | 3 / 0 | |
| 1.4.111 | 3 / 0 | |
| 1.4.110 | 3 / 0 | |
| 1.4.109 | 3 / 0 | |
| 1.4.108 | 3 / 0 | |
| 1.4.107 | 3 / 0 | |
| 1.4.106 | 3 / 0 | |
| 1.4.105 | 3 / 0 | |
| 1.4.104 | 3 / 0 | |
| 1.4.103 | 3 / 0 | |
| 1.4.101 | 3 / 0 | |
| 1.4.100 | 3 / 0 | |
| 1.4.99 | 3 / 0 | |
| 1.4.98 | 3 / 0 | |
| 1.4.97 | 3 / 0 | |
| 1.4.96 | 3 / 0 | |
| 1.4.95 | 3 / 0 | |
| 1.4.94 | 3 / 0 | |
| 1.4.93 | 3 / 0 | |
| 1.4.92 | 3 / 0 | |
| 1.4.91 | 3 / 0 | |
| 1.4.90 | 3 / 0 | |
| 1.4.89 | 3 / 0 | |
| 1.4.88 | 3 / 0 | |
| 1.4.87 | 3 / 0 | |
| 1.4.86 | 3 / 0 | |
| 1.4.85 | 3 / 0 | |
| 1.4.84 | 3 / 0 | |
| 1.4.83 | 3 / 0 | |
| 1.4.82 | 3 / 0 | |
| 1.4.81 | 3 / 0 |
v1.4.133
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.4.132
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.4.131
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.4.130
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.4.129
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.4.128
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.4.127
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.