← Home

@renovatebot/pgp

npm Repository Homepage
26
Versions
—
License
No
Install Scripts
Verified
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures No source commit

Maintainers

devops-mendviceicejamietanna

Keywords

renovatepgp

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
source-diff obfuscated-file:dist/dotnet/_framework/dotnet.native.js AI (source-diff): Standard .NET Emscripten WASM runtime bundle; minified build output, not obfuscation. ai
npm-metadata bundled-binaries AI (npm-metadata): Expected dotnet/teavm wasm build artifacts for a PGP library; stable across versions. ai
source-diff obfuscated-file:dist/dotnet/_framework/dotnet.runtime.js AI (source-diff): Official .NET Foundation WASM runtime bundle; minification is expected for this artifact. ai
source-diff net-exec-file:dist/dotnet/_framework/dotnet.native.js AI (source-diff): Emscripten-generated .NET native WASM loader; network+exec pattern is inherent to WASM module loading. ai
source-diff obfuscated-file:dist/dotnet/_framework/dotnet.js AI (source-diff): Official .NET Foundation WASM runtime bundle; minification is expected for this artifact. ai
source-diff net-exec-file:dist/dotnet/_framework/dotnet.runtime.js AI (source-diff): Official .NET Foundation WASM runtime; network+exec pattern is inherent to WASM module loading. ai
source-diff net-exec-file:dist/teavm/lib.wasm-runtime.js AI (source-diff): Apache-licensed TeaVM WASM runtime; network+exec pattern is inherent to WASM module loading. ai
source-diff source-size-tripled AI (source-diff): Size increase explained by newly added .NET and TeaVM WASM runtime artifacts from build:dotnet and build:java scripts. ai
source-diff encoded-string-file:dist/teavm/lib.js AI (source-diff): Encoded strings are EC curve constants and OIDs in a TeaVM-compiled PGP crypto library — expected and stable. ai
typosquat typosquat.levenshtein:pg AI (typosquat): Scoped under @renovatebot org; PGP library unrelated to the 'pg' postgres package. ai
typosquat typosquat.levenshtein:yup AI (typosquat): Scoped under @renovatebot org; no relation to 'yup' validation library. ai

Versions (showing 26 of 26)

Version Deps Published
1.3.16 0 / 15
1.3.15 0 / 15
1.3.14 0 / 15
1.3.13 0 / 15
1.3.12 0 / 15
1.3.11 0 / 15
1.3.10 0 / 15
1.3.9 0 / 15
1.3.8 0 / 15
1.3.7 0 / 15
1.3.6 0 / 15
1.3.5 0 / 15
1.3.4 0 / 15
1.3.3 0 / 15
1.3.2 0 / 15
1.3.1 0 / 15
1.3.0 0 / 15
1.2.5 0 / 15
1.2.4 0 / 15
1.2.3 0 / 15
1.2.2 0 / 15
1.2.1 0 / 15
1.2.0 0 / 15
1.1.1 0 / 15
1.0.2 0 / 12
1.0.1 0 / 12

v1.3.16

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.3.15

2 findings
HIGH Bundled binary files (10) npm-metadata

Package contains compiled binaries that could be backdoors: • dist/dotnet/_framework/BouncyCastle.Cryptography.wasm • dist/dotnet/_framework/dotnet.native.wasm • dist/dotnet/_framework/lib.wasm • dist/teavm/lib.wasm • dist/dotnet/_framework/System.Collections.Concurrent.wasm • dist/dotnet/_framework/System.IO.Compression.wasm • dist/dotnet/_framework/System.Linq.wasm • dist/dotnet/_framework/System.Private.CoreLib.wasm • dist/dotnet/_framework/System.Runtime.InteropServices.JavaScript.wasm • dist/dotnet/_framework/System.Security.Cryptography.wasm

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.3.4

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.3.3

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.3.2

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.3.1

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.3.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.2.5

2 findings
HIGH New obfuscated file: dist/dotnet/_framework/dotnet.native.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.2.4

2 findings
HIGH New obfuscated file: dist/dotnet/_framework/dotnet.native.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.2.3

2 findings
HIGH New obfuscated file: dist/dotnet/_framework/dotnet.native.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.2.2

2 findings
HIGH New obfuscated file: dist/dotnet/_framework/dotnet.native.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.2.1

2 findings
HIGH New obfuscated file: dist/dotnet/_framework/dotnet.native.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.2.0

2 findings
HIGH New obfuscated file: dist/dotnet/_framework/dotnet.native.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.1.1

2 findings
HIGH New obfuscated file: dist/dotnet/_framework/dotnet.native.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.