@reltio/hierarchy
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| provenance | no-provenance | AI (provenance): Internal Reltio package; no provenance is consistent across all versions in this org. | ai | |
| npm-metadata | no-description | AI (npm-metadata): Stable internal org package; missing description is a consistent pattern across versions, not a malware signal. | ai | |
| semgrep | semgrep:new-function-constructor | AI (semgrep): Fires in webpack bundle output; standard pattern for this org's UI packages across many versions. | ai | |
| dependencies | unvetted-dep:@reltio/mdm-sdk | AI (dependencies): Same org scope (@reltio); internal dependency consistent with this package's ecosystem. | ai | |
| dependencies | unvetted-dep:@reltio/mdm-module | AI (dependencies): Same org scope (@reltio); internal dependency consistent with this package's ecosystem. | ai | |
| bogus-package | bogus-package | AI (bogus-package): Internal enterprise component; missing metadata is expected, not a spam/malware indicator given 100-version history. | ai | |
| phantom-deps | phantom-dep:@reltio/mdm-sdk | AI (phantom-deps): Same org scope; phantom-dep heuristic unreliable for bundled internal packages. | ai | |
| phantom-deps | phantom-dep:@reltio/mdm-module | AI (phantom-deps): Same org scope; consistent with bundled internal module pattern. | ai | |
| phantom-deps | phantom-dep:@reltio/components | AI (phantom-deps): Same org scope; consistent with bundled internal component library pattern. | ai |
Versions (showing 51 of 114)
| Version | Deps | Published |
|---|---|---|
| 1.4.118 | 3 / 0 | |
| 1.4.117 | 3 / 0 | |
| 1.4.116 | 3 / 0 | |
| 1.4.115 | 3 / 0 | |
| 1.4.114 | 3 / 0 | |
| 1.4.113 | 3 / 0 | |
| 1.4.112 | 3 / 0 | |
| 1.4.111 | 3 / 0 | |
| 1.4.110 | 3 / 0 | |
| 1.4.109 | 3 / 0 | |
| 1.4.108 | 3 / 0 | |
| 1.4.107 | 3 / 0 | |
| 1.4.106 | 3 / 0 | |
| 1.4.105 | 3 / 0 | |
| 1.4.104 | 3 / 0 | |
| 1.4.103 | 3 / 0 | |
| 1.4.101 | 3 / 0 | |
| 1.4.100 | 3 / 0 | |
| 1.4.99 | 3 / 0 | |
| 1.4.98 | 3 / 0 | |
| 1.4.97 | 3 / 0 | |
| 1.4.96 | 3 / 0 | |
| 1.4.95 | 3 / 0 | |
| 1.4.94 | 3 / 0 | |
| 1.4.93 | 3 / 0 | |
| 1.4.92 | 3 / 0 | |
| 1.4.91 | 3 / 0 | |
| 1.4.90 | 3 / 0 | |
| 1.4.89 | 3 / 0 | |
| 1.4.88 | 3 / 0 | |
| 1.4.87 | 3 / 0 | |
| 1.4.86 | 3 / 0 | |
| 1.4.85 | 3 / 0 | |
| 1.4.84 | 3 / 0 | |
| 1.4.83 | 3 / 0 | |
| 1.4.82 | 3 / 0 | |
| 1.4.81 | 3 / 0 | |
| 1.4.80 | 3 / 0 | |
| 1.4.79 | 3 / 0 | |
| 1.4.78 | 3 / 0 | |
| 1.4.77 | 3 / 0 | |
| 1.4.76 | 3 / 0 | |
| 1.4.75 | 3 / 0 | |
| 1.4.74 | 3 / 0 | |
| 1.4.73 | 3 / 0 | |
| 1.4.72 | 3 / 0 | |
| 1.4.71 | 3 / 0 | |
| 1.4.70 | 3 / 0 | |
| 1.4.69 | 3 / 0 | |
| 1.4.68 | 3 / 0 | |
| 1.4.67 | 3 / 0 |
v1.4.118
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.4.117
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.4.116
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.4.115
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.4.114
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.4.113
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.4.112
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.4.111
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.4.110
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.4.109
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.4.108
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.4.107
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.4.106
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.4.105
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.4.104
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.4.103
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.4.101
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.4.100
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.4.99
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.4.98
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.4.97
2 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (egorshkov) than the most recent previously approved version (reltio-ui-coe) on 2026-04-23, but egorshkov is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v1.4.96
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.4.95
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.4.94
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.4.93
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.4.92
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.4.91
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.4.90
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.4.89
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.4.88
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.4.87
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.4.86
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.4.85
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.4.84
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.4.83
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.4.82
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.4.81
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.4.80
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.4.79
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.4.78
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.4.77
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.4.76
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.4.75
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.4.74
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.4.73
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.4.72
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.4.71
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.4.70
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.4.69
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.4.68
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.4.67
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.