@salesforce/plugin-auth
43
Versions
—
License
No
Install Scripts
Missing
Provenance
Supply chain provenance
Status for the latest visible version.
No SLSA provenance
npm registry signatures
No source commit
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
ire-npm-team-userjimjagsalesforce-releasesjasonschroeder-sfdcmobifylwc-adminsalesforce-admin
Keywords
forcesalesforcesalesforcedxsfsf-pluginsfdxsfdx-plugin
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| maintainer-change | maintainer-added | AI (maintainer-change): Salesforce is consolidating npm publishing under centralized service accounts (salesforce-admin/salesforce-releases). This is an organizational change, not a takeover signal. | ai | |
| maintainer-change | maintainer-removed | AI (maintainer-change): Mass removal of individual Salesforce developer accounts in favor of centralized service account is consistent with Salesforce's publishing consolidation strategy. | ai | |
| publish-pattern | dormant-publish | AI (publish-pattern): Package has 404 versions and active publisher salesforce-releases; dormancy signal is likely an artifact of the analyzer's tracking window, not a real takeover indicator. | ai | |
| semgrep | semgrep:api-obfuscation-reflect | AI (semgrep): Reflect.get(err, 'message') is defensive error handling, not obfuscation. This pattern is stable and benign for this package. | ai | |
| phantom-deps | phantom-dep:@inquirer/select | AI (phantom-deps): @inquirer/select is explicitly declared as a runtime dependency in package.json; the phantom-dep finding is a false positive. | ai |
Versions (showing 43 of 43)
| Version | Deps | Published |
|---|---|---|
| 4.4.8 | 9 / 9 | |
| 4.4.7 | 9 / 9 | |
| 4.4.6 | 9 / 9 | |
| 4.4.5 | 9 / 9 | |
| 4.4.4 | 9 / 9 | |
| 4.4.3 | 9 / 9 | |
| 4.4.2 | 9 / 9 | |
| 4.4.1 | 9 / 9 | |
| 4.4.0 | 9 / 9 | |
| 4.3.13 | 9 / 9 | |
| 4.3.12 | 9 / 9 | |
| 4.3.11 | 9 / 9 | |
| 4.3.10 | 9 / 9 | |
| 4.3.9 | 9 / 9 | |
| 4.3.8 | 9 / 9 | |
| 4.3.7 | 9 / 9 | |
| 4.3.6 | 9 / 9 | |
| 4.3.5 | 9 / 9 | |
| 4.3.4 | 9 / 9 | |
| 4.3.3 | 9 / 9 | |
| 4.3.2 | 9 / 9 | |
| 4.3.1 | 9 / 9 | |
| 4.3.0 | 9 / 9 | |
| 4.2.2 | 9 / 9 | |
| 4.2.1 | 9 / 9 | |
| 4.2.0 | 9 / 9 | |
| 4.1.8 | 9 / 9 | |
| 4.1.7 | 9 / 9 | |
| 4.1.6 | 9 / 9 | |
| 4.1.5 | 9 / 9 | |
| 4.1.4 | 9 / 9 | |
| 4.1.3 | 9 / 9 | |
| 4.1.2 | 9 / 9 | |
| 4.1.1 | 9 / 9 | |
| 4.1.0 | 9 / 9 | |
| 3.9.26 | 9 / 9 | |
| 3.9.25 | 9 / 9 | |
| 3.9.24 | 9 / 9 | |
| 3.9.23 | 9 / 9 | |
| 3.9.22 | 9 / 9 | |
| 3.9.19 | 9 / 9 | |
| 3.9.18 | 9 / 9 | |
| 3.9.17 | 9 / 9 |
v4.4.8
1 finding
LOW
No provenance attestation
provenance
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.4.7
1 finding
LOW
No provenance attestation
provenance
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.4.6
1 finding
LOW
No provenance attestation
provenance
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.