← Home

@sourceloop/core

npm Repository Homepage
7
Versions
—
License
No
Install Scripts
Verified
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures gitHead linked

Maintainers

samarpan_sfnpm-sourcefuseakshatdubeysfyeshasfabir.ganguly

Keywords

loopback-extensionloopback

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
typosquat typosquat.levenshtein:cors AI (typosquat): Scoped package @sourceloop/core is a LoopBack framework core, not a typosquat of cors. ai
semgrep semgrep:base64-decode AI (semgrep): Standard Basic Auth header decoding in swagger middleware; not obfuscation. ai

Versions (showing 7 of 7)

Version Deps Published
21.0.0 29 / 19
20.0.6 29 / 19
20.0.5 29 / 19
20.0.4 29 / 19
20.0.3 29 / 19
20.0.2 28 / 19
20.0.0 29 / 19

v20.0.3

2 findings
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

INFO Publisher changed: yeshasf → GitHub Actions (on 2026-02-06, now via trusted publisher with provenance) provenance

This version was published by a different npm account (GitHub Actions) than the most recent previously approved version (yeshasf) on 2026-02-06, but it carries Sigstore provenance attestation. This means the package moved to a trusted publisher (CI/CD with OIDC, e.g. GitHub Actions) — a supply-chain integrity improvement, not a compromise, since a stolen npm token cannot forge provenance bound to the source repository. Recorded as INFO for audit trail.

v20.0.2

2 findings
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

INFO Publisher changed: yeshasf → GitHub Actions (on 2026-01-02, now via trusted publisher with provenance) provenance

This version was published by a different npm account (GitHub Actions) than the most recent previously approved version (yeshasf) on 2026-01-02, but it carries Sigstore provenance attestation. This means the package moved to a trusted publisher (CI/CD with OIDC, e.g. GitHub Actions) — a supply-chain integrity improvement, not a compromise, since a stolen npm token cannot forge provenance bound to the source repository. Recorded as INFO for audit trail.