← Home

@synnaxlabs/alamos

npm Repository

Distributed instrumentation for Synnax

22
Versions
MIT
License
No
Install Scripts
Verified
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures No source commit

Maintainers

emilbon99pjdotson

Keywords

synnaxgrpctransportdata acquisitionbig datatelemetrycontrol systems

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
source-diff obfuscated-file:dist/instrumentation-lwMkPABv.cjs AI (source-diff): Vite-generated CJS bundle chunk; content is readable instrumentation code, not obfuscated malware. ai
source-diff obfuscated-file:dist/instrumentation-BUpiX8Rz.cjs AI (source-diff): Vite build artifact (minified CJS chunk); content is benign instrumentation/logging code with no suspicious behavior. ai
source-diff obfuscated-file:dist/instrumentation-CGaKhn8G.cjs AI (source-diff): Vite build artifact (content-hash CJS chunk); minified but contains only logging/instrumentation code, no obfuscation. ai
maintainer-change maintainer-added AI (maintainer-change): New maintainer added alongside CI/CD transition; consistent with legitimate org growth. ai
provenance publisher-changed AI (provenance): Transition to GitHub Actions CI publishing with SLSA attestation is the expected pattern for this monorepo. ai
publish-pattern dormant-publish AI (publish-pattern): Monorepo package; publish gaps reflect upstream release cadence, not account takeover. ai
dependencies unvetted-dep:@synnaxlabs/x AI (dependencies): Same-org monorepo sibling dependency; stable pattern across all versions of this package. ai

Versions (showing 22 of 22)

Version Deps Published
0.56.1 2 / 10
0.56.0 2 / 10
0.55.0 2 / 10
0.54.0 2 / 10
0.53.0 2 / 10
0.52.3 2 / 10
0.50.0 2 / 9
0.49.0 2 / 8
0.48.0 2 / 8
0.47.0 2 / 8
0.46.0 2 / 8
0.45.1 2 / 8
0.45.0 2 / 8
0.44.2 2 / 8
0.44.1 2 / 8
0.44.0 2 / 8
0.43.0 2 / 8
0.42.3 2 / 8
0.42.0 2 / 8
0.38.1 2 / 7
0.38.0 2 / 7
0.37.0 2 / 8

v0.38.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.38.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.37.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.