@sap-ux/environment-check
SAP Fiori environment check
Supply chain provenance
Status for the latest visible version.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| phantom-deps | phantom-dep:findit2 | AI (phantom-deps): Likely dynamic/indirect usage in a mature SAP tooling package; no malicious indicator. | ai | |
| provenance | publisher-changed | AI (provenance): Transition from human publisher to GitHub Actions CI/CD is confirmed by SLSA provenance attestation; expected for SAP open-ux-tools repo. | ai | |
| dependencies | unvetted-dep:@sap/bas-sdk | AI (dependencies): First-party SAP SDK; expected dependency for SAP BAS environment checks in this package. | ai | |
| provenance | no-provenance | AI (provenance): SAP UX monorepo packages consistently lack Sigstore provenance; stable false positive for this package family. | ai | |
| phantom-deps | phantom-dep:@sap-ux/ui5-config | AI (phantom-deps): @sap-ux/ui5-config is a declared dep in the same SAP monorepo; phantom-dep heuristic is a stable false positive here. | ai |
Versions (showing 100 of 436)
| Version | Deps | Published |
|---|---|---|
| 0.18.45 | 15 / 4 | |
| 0.18.44 | 15 / 4 | |
| 0.18.43 | 15 / 4 | |
| 0.18.42 | 15 / 4 | |
| 0.18.41 | 15 / 4 | |
| 0.18.40 | 15 / 4 | |
| 0.18.39 | 15 / 4 | |
| 0.18.38 | 15 / 4 | |
| 0.18.37 | 15 / 4 | |
| 0.18.36 | 15 / 4 | |
| 0.18.35 | 15 / 4 | |
| 0.18.34 | 15 / 4 | |
| 0.18.33 | 15 / 4 | |
| 0.18.32 | 15 / 4 | |
| 0.18.31 | 15 / 4 | |
| 0.18.30 | 15 / 4 | |
| 0.18.29 | 15 / 4 | |
| 0.18.28 | 15 / 4 | |
| 0.18.27 | 15 / 4 | |
| 0.18.26 | 15 / 4 | |
| 0.18.25 | 15 / 4 | |
| 0.18.24 | 15 / 4 | |
| 0.18.23 | 15 / 4 | |
| 0.18.22 | 15 / 4 | |
| 0.18.21 | 15 / 4 | |
| 0.18.20 | 15 / 4 | |
| 0.18.19 | 15 / 4 | |
| 0.18.18 | 15 / 4 | |
| 0.18.17 | 15 / 4 | |
| 0.18.16 | 15 / 4 | |
| 0.18.15 | 15 / 4 | |
| 0.18.14 | 15 / 4 | |
| 0.18.13 | 15 / 4 | |
| 0.18.12 | 15 / 4 | |
| 0.18.11 | 15 / 4 | |
| 0.18.10 | 15 / 4 | |
| 0.18.9 | 15 / 4 | |
| 0.18.8 | 15 / 4 | |
| 0.18.7 | 15 / 4 | |
| 0.18.6 | 15 / 4 | |
| 0.18.5 | 15 / 4 | |
| 0.18.4 | 15 / 4 | |
| 0.18.3 | 15 / 4 | |
| 0.18.2 | 15 / 4 | |
| 0.18.1 | 15 / 4 | |
| 0.18.0 | 15 / 4 | |
| 0.17.103 | 15 / 4 | |
| 0.17.102 | 15 / 4 | |
| 0.17.101 | 15 / 4 | |
| 0.17.100 | 15 / 4 | |
| 0.17.99 | 15 / 4 | |
| 0.17.98 | 15 / 4 | |
| 0.17.97 | 15 / 4 | |
| 0.17.96 | 15 / 4 | |
| 0.17.95 | 15 / 4 | |
| 0.17.94 | 15 / 4 | |
| 0.17.93 | 15 / 4 | |
| 0.17.92 | 15 / 4 | |
| 0.17.91 | 15 / 4 | |
| 0.17.90 | 15 / 4 | |
| 0.17.89 | 15 / 4 | |
| 0.17.88 | 15 / 4 | |
| 0.17.87 | 15 / 4 | |
| 0.17.86 | 15 / 4 | |
| 0.17.85 | 15 / 4 | |
| 0.17.84 | 15 / 4 | |
| 0.17.83 | 15 / 4 | |
| 0.17.82 | 15 / 4 | |
| 0.17.81 | 15 / 4 | |
| 0.17.80 | 15 / 4 | |
| 0.17.79 | 15 / 4 | |
| 0.17.78 | 15 / 4 | |
| 0.17.77 | 15 / 4 | |
| 0.17.76 | 15 / 4 | |
| 0.17.75 | 15 / 4 | |
| 0.17.74 | 15 / 4 | |
| 0.17.73 | 15 / 4 | |
| 0.17.72 | 15 / 4 | |
| 0.17.71 | 15 / 4 | |
| 0.17.69 | 15 / 4 | |
| 0.17.68 | 15 / 4 | |
| 0.17.67 | 15 / 4 | |
| 0.17.66 | 15 / 4 | |
| 0.17.65 | 15 / 4 | |
| 0.17.63 | 15 / 4 | |
| 0.17.62 | 15 / 4 | |
| 0.17.61 | 15 / 4 | |
| 0.17.60 | 15 / 4 | |
| 0.17.58 | 15 / 4 | |
| 0.17.57 | 15 / 4 | |
| 0.17.56 | 15 / 4 | |
| 0.17.55 | 15 / 4 | |
| 0.17.54 | 15 / 4 | |
| 0.17.53 | 15 / 4 | |
| 0.17.52 | 15 / 4 | |
| 0.17.51 | 15 / 4 | |
| 0.17.50 | 15 / 4 | |
| 0.17.49 | 15 / 4 | |
| 0.17.48 | 15 / 4 | |
| 0.17.47 | 15 / 4 |
v0.17.99
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.17.98
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.17.97
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.17.96
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.17.95
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.17.94
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.17.93
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.17.92
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.17.91
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.17.90
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.17.89
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.17.88
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.17.87
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.17.86
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.17.85
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.17.84
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.17.83
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.17.82
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.17.81
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.17.80
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.17.79
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.17.78
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.17.77
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.17.76
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.17.75
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.17.74
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.17.73
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.17.72
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.17.71
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.17.69
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.17.68
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.17.67
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.17.66
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.17.65
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.17.63
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.17.62
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.17.61
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.17.60
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.17.58
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.17.57
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.17.56
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.17.55
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.17.54
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.17.53
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.17.52
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.17.51
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.17.50
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.17.49
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.17.48
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.17.47
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.