@sap/approuter
19
Versions
—
License
No
Install Scripts
Missing
Provenance
Supply chain provenance
Status for the latest visible version.
No SLSA provenance
npm registry signatures
No source commit
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
sap_extncrepossap-ospo-admin
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| dependencies | unvetted-dep:@sap/logging | AI (dependencies): SAP-internal logging library; stable dependency of this package across many versions. | ai | |
| dependencies | unvetted-dep:@sap/e2e-trace | AI (dependencies): SAP-internal tracing library; stable dependency of this package across many versions. | ai | |
| dependencies | unvetted-dep:@sap/audit-logging | AI (dependencies): SAP-internal audit logging library; stable dependency of this package across many versions. | ai | |
| dependencies | unvetted-dep:cf-nodejs-logging-support | AI (dependencies): CF logging support library; stable dependency of this package across many versions. | ai | |
| dependencies | unvetted-dep:request-stats | AI (dependencies): Stable HTTP stats dependency; no malicious indicators. | ai | |
| provenance | no-provenance | AI (provenance): SAP internal package; no provenance is consistent across all prior versions. | ai | |
| semgrep | semgrep:dynamic-require | AI (semgrep): Dynamic require is used for pluggable session store loading — documented extension pattern for this package. | ai | |
| phantom-deps | phantom-dep:wtfnode | AI (phantom-deps): wtfnode is a declared runtime dep; phantom-dep heuristic false positive for this package. | ai | |
| semgrep | semgrep:hex-decode | AI (semgrep): Hex decoding used for AES-256-GCM IV/tag parsing in cookie crypto — legitimate cryptographic use. | ai | |
| semgrep | semgrep:base64-decode | AI (semgrep): Base64 decoding used to parse PEM certificates from destination config — standard TLS handling. | ai | |
| phantom-deps | phantom-dep:ms | AI (phantom-deps): ms is a declared runtime dep; phantom-dep heuristic false positive for this package. | ai | |
| phantom-deps | phantom-dep:mime | AI (phantom-deps): mime is a declared runtime dep; phantom-dep heuristic false positive for this package. | ai | |
| phantom-deps | phantom-dep:debug | AI (phantom-deps): debug is a declared runtime dep; phantom-dep heuristic false positive for this package. | ai |
Versions (showing 19 of 19)
| Version | Deps | Published |
|---|---|---|
| 22.0.3 | 49 / 20 | |
| 22.0.2 | 49 / 20 | |
| 22.0.1 | 49 / 20 | |
| 22.0.0 | 49 / 20 | |
| 21.5.0 | 49 / 20 | |
| 21.4.0 | 49 / 20 | |
| 21.3.0 | 50 / 20 | |
| 21.2.1 | 50 / 20 | |
| 21.2.0 | 50 / 20 | |
| 21.1.0 | 50 / 20 | |
| 21.0.0 | 50 / 20 | |
| 20.10.0 | 50 / 18 | |
| 20.9.0 | 50 / 18 | |
| 20.8.8 | 50 / 17 | |
| 20.8.7 | 50 / 17 | |
| 20.8.6 | 50 / 17 | |
| 20.8.5 | 50 / 17 | |
| 20.8.4 | 50 / 17 | |
| 20.8.3 | 50 / 17 |