@supernova-studio/pulsar-core
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| publish-pattern | new-deps-added | AI (publish-pattern): punycode is a well-known stdlib polyfill; no malicious indicators in this addition. | ai | |
| provenance | publisher-changed | AI (provenance): Transition to GitHub Actions CI publisher is consistent with org automation; stable for this package going forward. | ai | |
| maintainer-change | maintainer-added | AI (maintainer-change): sn-filipdanisko addition aligns with the org's CI migration; no malicious indicators. | ai | |
| bogus-package | bogus-package | AI (bogus-package): Established 350-version package; sparse README/keywords are a known pattern for this SDK component. | ai | |
| phantom-deps | phantom-dep:dot-prop | AI (phantom-deps): dot-prop declared in dependencies; phantom-dep heuristic false positive. | ai | |
| phantom-deps | phantom-dep:ts-dedent | AI (phantom-deps): ts-dedent declared in dependencies; phantom-dep heuristic false positive. | ai | |
| phantom-deps | phantom-dep:jsep | AI (phantom-deps): jsep is declared in dependencies and used via config; phantom-dep heuristic false positive for this package. | ai | |
| phantom-deps | phantom-dep:@jsep-plugin/object | AI (phantom-deps): @jsep-plugin/object declared in dependencies; phantom-dep heuristic false positive. | ai | |
| phantom-deps | phantom-dep:@jsep-plugin/ternary | AI (phantom-deps): @jsep-plugin/ternary declared in dependencies; phantom-dep heuristic false positive. | ai | |
| phantom-deps | phantom-dep:async-mutex | AI (phantom-deps): async-mutex declared in dependencies; phantom-dep heuristic false positive. | ai | |
| phantom-deps | phantom-dep:uuid | AI (phantom-deps): uuid declared in dependencies; phantom-dep heuristic false positive. | ai | |
| phantom-deps | phantom-dep:lodash | AI (phantom-deps): lodash declared in dependencies; phantom-dep heuristic false positive. | ai | |
| phantom-deps | phantom-dep:moment | AI (phantom-deps): moment declared in dependencies; phantom-dep heuristic false positive. | ai |
Versions (showing 38 of 38)
| Version | Deps | Published |
|---|---|---|
| 2.7.23 | 24 / 28 | |
| 2.7.21 | 24 / 28 | |
| 2.7.20 | 24 / 28 | |
| 2.7.19 | 24 / 28 | |
| 2.7.18 | 24 / 28 | |
| 2.7.17 | 24 / 28 | |
| 2.7.15 | 24 / 28 | |
| 2.7.14 | 25 / 28 | |
| 2.7.13 | 24 / 28 | |
| 2.7.12 | 24 / 28 | |
| 2.7.10 | 24 / 28 | |
| 2.7.9 | 24 / 28 | |
| 2.7.8 | 24 / 28 | |
| 2.7.7 | 24 / 28 | |
| 2.7.6 | 24 / 28 | |
| 2.7.5 | 24 / 28 | |
| 2.7.4 | 24 / 28 | |
| 2.7.3 | 24 / 28 | |
| 2.7.2 | 24 / 28 | |
| 2.7.1 | 24 / 28 | |
| 2.7.0 | 24 / 28 | |
| 2.6.33 | 24 / 28 | |
| 2.6.32 | 24 / 28 | |
| 2.6.31 | 24 / 28 | |
| 2.6.29 | 24 / 28 | |
| 2.6.28 | 24 / 28 | |
| 2.6.27 | 24 / 28 | |
| 2.6.25 | 24 / 28 | |
| 2.6.24 | 24 / 28 | |
| 2.6.23 | 24 / 28 | |
| 2.6.22 | 24 / 28 | |
| 2.6.21 | 24 / 28 | |
| 2.6.20 | 24 / 28 | |
| 2.6.19 | 24 / 28 | |
| 2.6.18 | 24 / 28 | |
| 2.6.17 | 24 / 28 | |
| 2.6.16 | 24 / 28 | |
| 2.6.15 | 24 / 28 |
v2.7.23
2 findingsThis version was published by a different npm account than previous versions on 2026-06-02. This could indicate a legitimate maintainer transition or an account compromise.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.7.21
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.7.20
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v2.7.19
2 findingsThis version was published by a different npm account than previous versions on 2026-03-27. This could indicate a legitimate maintainer transition or an account compromise.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.7.18
2 findingsThis version was published by a different npm account than previous versions on 2026-03-27. This could indicate a legitimate maintainer transition or an account compromise.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.7.17
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.7.15
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.7.14
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.7.13
2 findingsThis version was published by a different npm account than previous versions on 2026-03-15. This could indicate a legitimate maintainer transition or an account compromise.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.7.12
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v2.7.10
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.7.9
2 findingsThis version was published by a different npm account than previous versions on 2026-01-05. This could indicate a legitimate maintainer transition or an account compromise.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.7.8
2 findingsThis version was published by a different npm account than previous versions on 2025-12-17. This could indicate a legitimate maintainer transition or an account compromise.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.7.7
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v2.7.6
2 findingsThis version was published by a different npm account than previous versions on 2025-11-24. This could indicate a legitimate maintainer transition or an account compromise.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.7.5
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.7.4
2 findingsThis version was published by a different npm account than previous versions on 2025-08-18. This could indicate a legitimate maintainer transition or an account compromise.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.7.3
2 findingsThis version was published by a different npm account than previous versions on 2025-06-20. This could indicate a legitimate maintainer transition or an account compromise.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.7.2
2 findingsThis version was published by a different npm account than previous versions on 2025-06-20. This could indicate a legitimate maintainer transition or an account compromise.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.7.1
2 findingsThis version was published by a different npm account than previous versions on 2025-06-19. This could indicate a legitimate maintainer transition or an account compromise.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.7.0
2 findingsThis version was published by a different npm account than previous versions on 2025-06-18. This could indicate a legitimate maintainer transition or an account compromise.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.6.33
2 findingsThis version was published by a different npm account than previous versions on 2025-06-15. This could indicate a legitimate maintainer transition or an account compromise.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.6.32
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.6.31
2 findingsThis version was published by a different npm account than previous versions on 2025-06-02. This could indicate a legitimate maintainer transition or an account compromise.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.6.29
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.6.28
2 findingsThis version was published by a different npm account than previous versions on 2025-06-02. This could indicate a legitimate maintainer transition or an account compromise.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.6.27
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.6.25
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.6.24
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.6.23
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.6.22
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.6.21
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.6.20
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.6.19
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v2.6.18
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v2.6.17
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v2.6.16
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v2.6.15
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.