@segment/analytics-browser-actions-reddit-pixel
18
Versions
MIT
License
No
Install Scripts
Verified
Provenance
Supply chain provenance
Status for the latest visible version.
SLSA provenance attestation
npm registry signatures
gitHead linked
Maintainers
twilio-supply-chainsegmentiosegment-admin
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| provenance | publisher-changed | AI (provenance): Org-wide migration to CI/CD publishing with SLSA provenance, not a compromise. | ai | |
| maintainer-change | maintainer-added | AI (maintainer-change): Twilio/Segment supply-chain automation account replacing individual maintainers org-wide. | ai | |
| maintainer-change | maintainer-removed | AI (maintainer-change): Expected cleanup of individual maintainers as publishing moves to CI bot across monorepo. | ai | |
| bogus-package | bogus-package | AI (bogus-package): Scoped Segment analytics plugin; sparse metadata is typical for this package family, not a spam indicator. | ai | |
| npm-metadata | no-description | AI (npm-metadata): Consistent across Segment's browser-actions plugin family; not a malice signal. | ai |
Versions (showing 18 of 18)
| Version | Deps | Published |
|---|---|---|
| 1.18.0 | 1 / 0 | |
| 1.17.0 | 1 / 0 | |
| 1.16.0 | 1 / 0 | |
| 1.15.0 | 1 / 0 | |
| 1.14.0 | 1 / 0 | |
| 1.13.0 | 1 / 0 | |
| 1.12.0 | 1 / 0 | |
| 1.11.0 | 1 / 0 | |
| 1.10.0 | 1 / 0 | |
| 1.9.0 | 1 / 0 | |
| 1.8.0 | 1 / 0 | |
| 1.7.0 | 1 / 0 | |
| 1.6.0 | 1 / 0 | |
| 1.5.0 | 1 / 0 | |
| 1.4.0 | 1 / 0 | |
| 1.3.0 | 1 / 0 | |
| 1.2.0 | 1 / 0 | |
| 1.1.0 | 1 / 0 |
v1.18.0
1 finding
INFO
Has SLSA provenance attestation
provenance
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.17.0
2 findings
HIGH
Publisher changed: varadarajan-tw → GitHub Actions (on 2026-07-09)
provenance
This version was published by a different npm account than previous versions on 2026-07-09. This could indicate a legitimate maintainer transition or an account compromise.
INFO
Has SLSA provenance attestation
provenance
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.