@sap/cds No license 33 versions

@sap/cds

npm Homepage

33

Versions

—

License

No

Install Scripts

Missing

Provenance

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures No source commit

Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.

Maintainers

sap_extncrepos

Keywords

CAPCDS

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
publish-pattern	dormant-publish	AI (publish-pattern): Diff is against a higher semver (v9.8.2); this is a maintenance release on an older branch, not a true dormancy/takeover signal.	ai	2026/05/19
dependencies	unvetted-dep:@sap/cds-foss	AI (dependencies): Same SAP org scope as this package; consistent with SAP's internal dependency pattern.	ai	2026/05/16
semgrep	semgrep:api-obfuscation-reflect	AI (semgrep): Reflect.get used in a legitimate Proxy handler for struct flattening; not obfuscation.	ai	2026/04/30
semgrep	semgrep:dynamic-require	AI (semgrep): Dynamic require for optional livereload middleware; config-driven, not arbitrary user input.	ai	2026/04/29
semgrep	semgrep:child-process-import	AI (semgrep): Used for service bindings registry management; expected in a full-stack framework CLI.	ai	2026/04/29
typosquat	typosquat.levenshtein:cors	AI (typosquat): Scoped @sap package; Levenshtein match to 'cors' is a false positive for this well-known SAP framework.	ai	2026/04/29
phantom-deps	phantom-dep:@sap/cds-fiori	AI (phantom-deps): Same SAP org scope; declared as runtime dep and likely loaded conditionally at runtime.	ai	2026/04/29
semgrep	semgrep:child-process-spawn	AI (semgrep): tar-win.js spawns tar for Windows compatibility; documented framework utility.	ai	2026/04/29
typosquat	typosquat.levenshtein:qs	AI (typosquat): Scoped @sap package; Levenshtein match to 'qs' is a false positive for this well-known SAP framework.	ai	2026/04/29
semgrep	semgrep:base64-decode	AI (semgrep): Standard HTTP Basic Auth header decoding; not obfuscation or payload hiding.	ai	2026/04/29

Versions (showing 33 of 33)

Version	Deps	Published
9.9.1	4 / 0	2026-04-28
9.9.0	4 / 0	2026-04-23
9.8.5	4 / 0	2026-04-08
9.8.4	4 / 0	2026-03-26
9.8.3	4 / 0	2026-03-12
9.8.2	4 / 0	2026-03-10
9.8.1	4 / 0	2026-03-09
9.8.0	4 / 0	2026-03-09
9.7.1	4 / 0	2026-02-06
9.7.0	4 / 0	2026-02-02
9.6.4	3 / 0	2026-01-20
9.6.3	3 / 0	2026-01-15
9.6.2	3 / 0	2026-01-08
9.6.1	3 / 0	2025-12-18
9.6.0	3 / 0	2025-12-16
9.5.2	3 / 0	2025-12-09
9.5.1	3 / 0	2025-12-01
9.4.5	3 / 0	2025-11-10
9.4.4	3 / 0	2025-10-23
9.4.3	3 / 0	2025-10-10
9.4.2	3 / 0	2025-10-08
9.3.1	3 / 0	2025-09-03
9.3.0	3 / 0	2025-09-01
9.2.1	3 / 0	2025-08-15
9.2.0	3 / 0	2025-07-31
9.1.0	3 / 0	2025-07-02
9.0.4	3 / 0	2025-06-18
9.0.3	3 / 0	2025-06-04
9.0.2	3 / 0	2025-06-02
8.9.10	3 / 0	2026-04-28
8.9.9	3 / 0	2026-03-12
8.9.8	3 / 0	2025-12-18
8.9.7	3 / 0	2025-11-10

v9.9.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v9.8.5

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v9.8.4

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v9.8.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v9.8.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v9.8.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v9.8.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v9.7.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v9.7.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v9.6.4

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v9.6.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v9.6.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v9.6.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v9.6.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v9.5.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v9.5.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v9.4.5

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v9.4.4

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v9.4.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v9.4.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v9.3.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v9.3.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v9.2.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v9.2.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v9.1.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v9.0.4

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v9.0.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v9.0.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v8.9.10

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v8.9.9

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v8.9.8

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v8.9.7

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.