← Home

@shgysk8zer0/polyfills

npm Repository Homepage
7
Versions
—
License
Yes
Install Scripts
Verified
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures gitHead linked

Maintainers

shgysk8zer0

Keywords

polyfillsshims

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
install-scripts install-script:postinstall AI (install-scripts): Conditional build step only runs if a dev asset file exists; harmless for end-users installing the package. ai
dependencies unvetted-dep:@aegisjsproject/sanitizer AI (dependencies): Part of the same author's ecosystem; legitimate polyfill dependency. ai
dependencies unvetted-dep:@aegisjsproject/trusted-types AI (dependencies): Part of the same author's ecosystem; legitimate polyfill dependency. ai

Versions (showing 7 of 7)

Version Deps Published
0.6.3 2 / 9
0.5.5 2 / 9
0.5.2 2 / 9
0.5.1 2 / 9
0.5.0 2 / 9
0.4.13 2 / 8
0.4.12 2 / 8

v0.6.3

2 findings
HIGH Package has 'postinstall' script install-scripts

Script: if [ -f './assets/dedent.cjs' ]; then npm run build; fi

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.5.5

2 findings
HIGH Package has 'postinstall' script install-scripts

Script: if [ -f './assets/dedent.cjs' ]; then npm run build; fi

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.5.2

2 findings
HIGH Package has 'postinstall' script install-scripts

Script: if [ -f './assets/dedent.cjs' ]; then npm run build; fi

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.5.1

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.5.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.4.13

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.4.12

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.