@supernova-studio/pulsar-core
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| publish-pattern | new-deps-added | AI (publish-pattern): punycode is a well-known stdlib polyfill; no malicious indicators in this addition. | ai | |
| provenance | publisher-changed | AI (provenance): Transition to GitHub Actions CI publisher is consistent with org automation; stable for this package going forward. | ai | |
| maintainer-change | maintainer-added | AI (maintainer-change): sn-filipdanisko addition aligns with the org's CI migration; no malicious indicators. | ai | |
| bogus-package | bogus-package | AI (bogus-package): Established 350-version package; sparse README/keywords are a known pattern for this SDK component. | ai | |
| phantom-deps | phantom-dep:dot-prop | AI (phantom-deps): dot-prop declared in dependencies; phantom-dep heuristic false positive. | ai | |
| phantom-deps | phantom-dep:ts-dedent | AI (phantom-deps): ts-dedent declared in dependencies; phantom-dep heuristic false positive. | ai | |
| phantom-deps | phantom-dep:jsep | AI (phantom-deps): jsep is declared in dependencies and used via config; phantom-dep heuristic false positive for this package. | ai | |
| phantom-deps | phantom-dep:@jsep-plugin/object | AI (phantom-deps): @jsep-plugin/object declared in dependencies; phantom-dep heuristic false positive. | ai | |
| phantom-deps | phantom-dep:@jsep-plugin/ternary | AI (phantom-deps): @jsep-plugin/ternary declared in dependencies; phantom-dep heuristic false positive. | ai | |
| phantom-deps | phantom-dep:async-mutex | AI (phantom-deps): async-mutex declared in dependencies; phantom-dep heuristic false positive. | ai | |
| phantom-deps | phantom-dep:uuid | AI (phantom-deps): uuid declared in dependencies; phantom-dep heuristic false positive. | ai | |
| phantom-deps | phantom-dep:lodash | AI (phantom-deps): lodash declared in dependencies; phantom-dep heuristic false positive. | ai | |
| phantom-deps | phantom-dep:moment | AI (phantom-deps): moment declared in dependencies; phantom-dep heuristic false positive. | ai |
Versions (showing 51 of 119)
| Version | Deps | Published |
|---|---|---|
| 2.8.1 | 24 / 28 | |
| 2.8.0 | 24 / 28 | |
| 2.7.28 | 24 / 28 | |
| 2.7.27 | 24 / 28 | |
| 2.7.26 | 24 / 28 | |
| 2.7.25 | 24 / 28 | |
| 2.7.24 | 24 / 28 | |
| 2.7.23 | 24 / 28 | |
| 2.7.21 | 24 / 28 | |
| 2.7.20 | 24 / 28 | |
| 2.7.19 | 24 / 28 | |
| 2.7.18 | 24 / 28 | |
| 2.7.17 | 24 / 28 | |
| 2.7.15 | 24 / 28 | |
| 2.7.14 | 25 / 28 | |
| 2.7.13 | 24 / 28 | |
| 2.7.12 | 24 / 28 | |
| 2.7.10 | 24 / 28 | |
| 2.7.9 | 24 / 28 | |
| 2.7.8 | 24 / 28 | |
| 2.7.7 | 24 / 28 | |
| 2.7.6 | 24 / 28 | |
| 2.7.5 | 24 / 28 | |
| 2.7.4 | 24 / 28 | |
| 2.7.3 | 24 / 28 | |
| 2.7.2 | 24 / 28 | |
| 2.7.1 | 24 / 28 | |
| 2.7.0 | 24 / 28 | |
| 2.6.33 | 24 / 28 | |
| 2.6.32 | 24 / 28 | |
| 2.6.31 | 24 / 28 | |
| 2.6.29 | 24 / 28 | |
| 2.6.28 | 24 / 28 | |
| 2.6.27 | 24 / 28 | |
| 2.6.25 | 24 / 28 | |
| 2.6.24 | 24 / 28 | |
| 2.6.23 | 24 / 28 | |
| 2.6.22 | 24 / 28 | |
| 2.6.21 | 24 / 28 | |
| 2.6.20 | 24 / 28 | |
| 2.6.19 | 24 / 28 | |
| 2.6.18 | 24 / 28 | |
| 2.6.17 | 24 / 28 | |
| 2.6.16 | 24 / 28 | |
| 2.6.15 | 24 / 28 | |
| 2.6.14 | 24 / 28 | |
| 2.6.13 | 24 / 28 | |
| 2.6.12 | 24 / 28 | |
| 2.6.11 | 24 / 27 | |
| 2.6.10 | 24 / 27 | |
| 2.6.9 | 24 / 27 |
v2.8.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.8.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.7.28
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.6.14
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.6.13
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.6.12
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.6.11
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.6.10
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.6.9
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.