← Home

@stoplight/json-ref-resolver

npm Repository Homepage
17
Versions
—
License
No
Install Scripts
Missing
Provenance

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures No source commit

Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.

Maintainers

stoplight-devops

Keywords

json-parserjsonjsonschemajson-schemajson-pointer$refresolveropenapiswaggerdereferenceresolve

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
provenance publisher-changed-stale AI (provenance): Same org migration, long-stable, not a takeover pattern. ai
maintainer-change maintainer-takeover AI (maintainer-change): Org-account migration, stable 4+ years, publisher has 262 approved packages. ai
publish-pattern dormant-publish AI (publish-pattern): Dormancy explained by same org-transition event, not compromise. ai
maintainer-change maintainer-removed AI (maintainer-change): Consistent with maintainer-added; normal team turnover. ai
maintainer-change maintainer-added AI (maintainer-change): Org-wide team roster rotation on a well-established Stoplight package. ai
dependencies unvetted-dep:lodash.set AI (dependencies): Official lodash granular module, genuinely imported/used in runner.js; standard refactor from full lodash. ai
phantom-deps phantom-dep:@types/urijs AI (phantom-deps): @types/urijs is a TypeScript type definition package; listing it as a runtime dep without direct import is a common pattern for TS packages. Stable false positive for this package. ai

Versions (showing 17 of 17)

Version Deps Published
3.1.6 10 / 0
3.1.5 10 / 0
3.1.4 10 / 0
3.1.3 11 / 0
3.1.2 11 / 0
3.1.1 11 / 0
3.1.0 10 / 0
3.0.9 10 / 0
3.0.8 10 / 0
3.0.7 10 / 0
3.0.6 10 / 0
3.0.5 10 / 0
3.0.4 10 / 0
3.0.3 10 / 0
3.0.2 10 / 0
3.0.1 10 / 0
3.0.0 10 / 0

v3.1.5

2 findings
MEDIUM Publisher changed: marbemac → stoplight-devops (on 2022-12-13, unremoved on npm for 1316d) provenance

This version was published by a different npm account (stoplight-devops) than the most recent previously approved version (marbemac) on 2022-12-13. It has since remained available on npm for 1316 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.1.4

2 findings
MEDIUM Publisher changed: marbemac → stoplight-devops (on 2022-06-06, unremoved on npm for 1506d) provenance

This version was published by a different npm account (stoplight-devops) than the most recent previously approved version (marbemac) on 2022-06-06. It has since remained available on npm for 1506 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.1.3

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.1.2

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.1.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.1.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.0.9

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.0.8

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.0.7

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.0.6

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.0.5

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.0.4

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.0.3

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.0.2

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.0.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v3.0.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.