@sap/approuter
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| dependencies | unvetted-dep:@sap/logging | AI (dependencies): SAP-internal logging library; stable dependency of this package across many versions. | ai | |
| dependencies | unvetted-dep:@sap/e2e-trace | AI (dependencies): SAP-internal tracing library; stable dependency of this package across many versions. | ai | |
| dependencies | unvetted-dep:@sap/audit-logging | AI (dependencies): SAP-internal audit logging library; stable dependency of this package across many versions. | ai | |
| dependencies | unvetted-dep:cf-nodejs-logging-support | AI (dependencies): CF logging support library; stable dependency of this package across many versions. | ai | |
| dependencies | unvetted-dep:request-stats | AI (dependencies): Stable HTTP stats dependency; no malicious indicators. | ai | |
| provenance | no-provenance | AI (provenance): SAP internal package; no provenance is consistent across all prior versions. | ai | |
| semgrep | semgrep:dynamic-require | AI (semgrep): Dynamic require is used for pluggable session store loading — documented extension pattern for this package. | ai | |
| phantom-deps | phantom-dep:wtfnode | AI (phantom-deps): wtfnode is a declared runtime dep; phantom-dep heuristic false positive for this package. | ai | |
| semgrep | semgrep:hex-decode | AI (semgrep): Hex decoding used for AES-256-GCM IV/tag parsing in cookie crypto — legitimate cryptographic use. | ai | |
| semgrep | semgrep:base64-decode | AI (semgrep): Base64 decoding used to parse PEM certificates from destination config — standard TLS handling. | ai | |
| phantom-deps | phantom-dep:ms | AI (phantom-deps): ms is a declared runtime dep; phantom-dep heuristic false positive for this package. | ai | |
| phantom-deps | phantom-dep:mime | AI (phantom-deps): mime is a declared runtime dep; phantom-dep heuristic false positive for this package. | ai | |
| phantom-deps | phantom-dep:debug | AI (phantom-deps): debug is a declared runtime dep; phantom-dep heuristic false positive for this package. | ai |
Versions (showing 17 of 17)
| Version | Deps | Published |
|---|---|---|
| 22.0.1 | 49 / 20 | |
| 22.0.0 | 49 / 20 | |
| 21.5.0 | 49 / 20 | |
| 21.4.0 | 49 / 20 | |
| 21.3.0 | 50 / 20 | |
| 21.2.1 | 50 / 20 | |
| 21.2.0 | 50 / 20 | |
| 21.1.0 | 50 / 20 | |
| 21.0.0 | 50 / 20 | |
| 20.10.0 | 50 / 18 | |
| 20.9.0 | 50 / 18 | |
| 20.8.8 | 50 / 17 | |
| 20.8.7 | 50 / 17 | |
| 20.8.6 | 50 / 17 | |
| 20.8.5 | 50 / 17 | |
| 20.8.4 | 50 / 17 | |
| 20.8.3 | 50 / 17 |
v22.0.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v22.0.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v21.5.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v21.4.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v21.3.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v21.2.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v21.2.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v21.1.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v21.0.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v20.10.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v20.9.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v20.8.8
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v20.8.7
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v20.8.6
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v20.8.5
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v20.8.4
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v20.8.3
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.