@teambit/api-reference
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| maintainer-change | maintainer-removed | AI (maintainer-change): Routine maintainer roster churn in large monorepo; no accompanying suspicious behavior. | ai | |
| publish-pattern | new-deps-added | AI (publish-pattern): New deps are lodash and same-org monorepo packages; benign for this ecosystem. | ai | |
| dependencies | unvetted-dep:@teambit/api-reference.renderers.inference-type | AI (dependencies): Internal teambit sub-package from established org; not an independent risk. | ai | |
| dependencies | unvetted-dep:@teambit/api-reference.renderers.type-literal | AI (dependencies): Internal teambit sub-package from established org; not an independent risk. | ai | |
| dependencies | unvetted-dep:@teambit/api-reference.renderers.unresolved | AI (dependencies): Internal teambit sub-package from established org; not an independent risk. | ai | |
| dependencies | unvetted-dep:@teambit/api-reference.renderers.type-union | AI (dependencies): Internal teambit sub-package from established org; not an independent risk. | ai | |
| dependencies | unvetted-dep:@teambit/api-reference.renderers.type-array | AI (dependencies): Internal teambit sub-package from established org; not an independent risk. | ai | |
| dependencies | unvetted-dep:@teambit/api-reference.renderers.tuple-type | AI (dependencies): Internal teambit sub-package from established org; not an independent risk. | ai | |
| dependencies | unvetted-dep:@teambit/api-reference.renderers.interface | AI (dependencies): Internal teambit sub-package from established org; not an independent risk. | ai | |
| dependencies | unvetted-dep:@teambit/api-reference.renderers.decorator | AI (dependencies): Internal teambit sub-package from established org; not an independent risk. | ai | |
| dependencies | unvetted-dep:@teambit/api-reference.renderers.variable | AI (dependencies): Internal teambit sub-package from established org; not an independent risk. | ai | |
| dependencies | unvetted-dep:@teambit/api-reference.renderers.type-ref | AI (dependencies): Internal teambit sub-package from established org; not an independent risk. | ai | |
| dependencies | unvetted-dep:@teambit/api-reference.renderers.function | AI (dependencies): Internal teambit sub-package from established org; not an independent risk. | ai | |
| dependencies | unvetted-dep:@teambit/api-reference.renderers.class | AI (dependencies): Internal teambit sub-package from established org; not an independent risk. | ai | |
| dependencies | unvetted-dep:@teambit/api-reference.renderers.type | AI (dependencies): Internal teambit sub-package from established org; not an independent risk. | ai | |
| dependencies | unvetted-dep:@teambit/api-reference.renderers.enum | AI (dependencies): Internal teambit sub-package from established org; not an independent risk. | ai | |
| dependencies | unvetted-dep:@teambit/api-reference.renderers.this | AI (dependencies): Internal teambit sub-package from established org; not an independent risk. | ai | |
| dependencies | unvetted-dep:@teambit/api-reference.renderers.type-intersection | AI (dependencies): Internal teambit sub-package from established org; not an independent risk. | ai | |
| publish-pattern | rapid-publish | AI (publish-pattern): teambit uses automated CI pipelines that publish many packages in rapid succession; consistent pattern across 2454 versions. | ai | |
| npm-metadata | no-description | AI (npm-metadata): Mature scoped package with clear purpose; missing description is cosmetic. | ai | |
| provenance | no-provenance | AI (provenance): Only ~12% of npm packages have provenance; not a disqualifier for established packages. | ai | |
| dependencies | unvetted-dep:@teambit/component.ui.component-compare.models.component-compare-props | AI (dependencies): Sibling @teambit/* package from the same well-known Bit monorepo; stable false positive. | ai | |
| dependencies | unvetted-dep:@teambit/api-reference.renderers.default-node-renderers | AI (dependencies): Sibling @teambit/* package from the same well-known Bit monorepo; stable false positive. | ai | |
| dependencies | unvetted-dep:@teambit/api-reference.sections.api-reference-section | AI (dependencies): Sibling @teambit/* package from the same well-known Bit monorepo; stable false positive. | ai | |
| dependencies | unvetted-dep:@teambit/api-reference.sections.api-reference-page | AI (dependencies): Sibling @teambit/* package from the same well-known Bit monorepo; stable false positive. | ai | |
| dependencies | unvetted-dep:@teambit/component.ui.component-compare.context | AI (dependencies): Sibling @teambit/* package from the same well-known Bit monorepo; stable false positive. | ai | |
| dependencies | unvetted-dep:@teambit/api-reference.models.api-node-renderer | AI (dependencies): Sibling @teambit/* package from the same well-known Bit monorepo; stable false positive. | ai | |
| dependencies | unvetted-dep:@teambit/api-reference.hooks.use-api-renderers | AI (dependencies): Sibling @teambit/* package from the same well-known Bit monorepo; stable false positive. | ai | |
| dependencies | unvetted-dep:@teambit/semantics.entities.semantic-schema | AI (dependencies): Sibling @teambit/* package from the same well-known Bit monorepo; stable false positive. | ai | |
| dependencies | unvetted-dep:@teambit/component-compare | AI (dependencies): Sibling @teambit/* package from the same well-known Bit monorepo; stable false positive. | ai | |
| dependencies | unvetted-dep:@teambit/tagged-exports | AI (dependencies): Sibling @teambit/* package from the same well-known Bit monorepo; stable false positive. | ai | |
| dependencies | unvetted-dep:@teambit/workspace | AI (dependencies): Sibling @teambit/* package from the same well-known Bit monorepo; stable false positive. | ai | |
| dependencies | unvetted-dep:@teambit/component | AI (dependencies): Sibling @teambit/* package from the same well-known Bit monorepo; stable false positive. | ai | |
| dependencies | unvetted-dep:@teambit/harmony | AI (dependencies): Sibling @teambit/* package from the same well-known Bit monorepo; stable false positive. | ai | |
| dependencies | unvetted-dep:@teambit/ui | AI (dependencies): Sibling @teambit/* package from the same well-known Bit monorepo; stable false positive. | ai | |
| dependencies | unvetted-dep:@teambit/code | AI (dependencies): Sibling @teambit/* package from the same well-known Bit monorepo; stable false positive. | ai | |
| dependencies | unvetted-dep:@teambit/component.ui.component-compare.models.component-compare-change-type | AI (dependencies): Sibling @teambit/* package from the same well-known Bit monorepo; stable false positive. | ai |
Versions (showing 100 of 152)
| Version | Deps | Published |
|---|---|---|
| 1.0.1073 | 17 / 3 | |
| 1.0.1066 | 17 / 3 | |
| 1.0.1052 | 17 / 3 | |
| 1.0.1021 | 17 / 3 | |
| 1.0.988 | 17 / 3 | |
| 1.0.972 | 17 / 3 | |
| 1.0.971 | 17 / 3 | |
| 1.0.970 | 17 / 3 | |
| 1.0.969 | 17 / 3 | |
| 1.0.968 | 17 / 3 | |
| 1.0.966 | 17 / 3 | |
| 1.0.962 | 17 / 3 | |
| 1.0.955 | 17 / 3 | |
| 1.0.953 | 17 / 3 | |
| 1.0.948 | 17 / 3 | |
| 1.0.945 | 17 / 3 | |
| 1.0.943 | 17 / 3 | |
| 1.0.941 | 17 / 3 | |
| 1.0.939 | 17 / 3 | |
| 1.0.932 | 17 / 3 | |
| 1.0.930 | 17 / 3 | |
| 1.0.929 | 17 / 3 | |
| 1.0.925 | 13 / 3 | |
| 1.0.770 | 13 / 3 | |
| 1.0.763 | 13 / 3 | |
| 1.0.761 | 13 / 3 | |
| 1.0.746 | 13 / 3 | |
| 1.0.654 | 29 / 3 | |
| 1.0.643 | 29 / 3 | |
| 1.0.639 | 29 / 3 | |
| 1.0.632 | 29 / 3 | |
| 1.0.615 | 29 / 3 | |
| 1.0.611 | 29 / 3 | |
| 1.0.254 | 28 / 4 | |
| 1.0.228 | 27 / 4 | |
| 1.0.173 | 27 / 4 | |
| 1.0.116 | 26 / 5 | |
| 1.0.115 | 23 / 4 | |
| 1.0.114 | 23 / 4 | |
| 1.0.113 | 23 / 4 | |
| 1.0.112 | 23 / 4 | |
| 1.0.111 | 23 / 4 | |
| 1.0.110 | 23 / 4 | |
| 1.0.109 | 23 / 4 | |
| 1.0.108 | 23 / 4 | |
| 1.0.107 | 25 / 7 | |
| 1.0.106 | 25 / 7 | |
| 1.0.105 | 25 / 7 | |
| 1.0.104 | 25 / 7 | |
| 1.0.103 | 25 / 7 | |
| 1.0.102 | 25 / 7 | |
| 1.0.101 | 25 / 7 | |
| 1.0.100 | 25 / 7 | |
| 1.0.99 | 25 / 7 | |
| 1.0.98 | 25 / 7 | |
| 1.0.97 | 25 / 7 | |
| 1.0.96 | 25 / 7 | |
| 1.0.95 | 25 / 7 | |
| 1.0.94 | 25 / 7 | |
| 1.0.93 | 25 / 7 | |
| 1.0.92 | 25 / 7 | |
| 1.0.91 | 25 / 7 | |
| 1.0.90 | 25 / 7 | |
| 1.0.89 | 25 / 7 | |
| 1.0.88 | 25 / 7 | |
| 1.0.87 | 25 / 7 | |
| 1.0.86 | 25 / 7 | |
| 1.0.85 | 25 / 7 | |
| 1.0.84 | 25 / 7 | |
| 1.0.83 | 25 / 7 | |
| 1.0.82 | 25 / 7 | |
| 1.0.81 | 25 / 7 | |
| 1.0.80 | 25 / 7 | |
| 1.0.79 | 25 / 7 | |
| 1.0.78 | 25 / 7 | |
| 1.0.77 | 25 / 7 | |
| 1.0.76 | 25 / 7 | |
| 1.0.75 | 25 / 7 | |
| 1.0.74 | 25 / 7 | |
| 1.0.73 | 25 / 7 | |
| 1.0.72 | 25 / 7 | |
| 1.0.71 | 25 / 7 | |
| 1.0.70 | 25 / 7 | |
| 1.0.69 | 25 / 7 | |
| 1.0.68 | 25 / 7 | |
| 1.0.67 | 25 / 7 | |
| 1.0.66 | 25 / 7 | |
| 1.0.65 | 25 / 7 | |
| 1.0.64 | 25 / 7 | |
| 1.0.63 | 25 / 7 | |
| 1.0.62 | 25 / 7 | |
| 1.0.61 | 25 / 7 | |
| 1.0.60 | 25 / 7 | |
| 1.0.59 | 25 / 7 | |
| 1.0.58 | 25 / 7 | |
| 1.0.57 | 25 / 7 | |
| 1.0.56 | 25 / 7 | |
| 1.0.55 | 25 / 7 | |
| 1.0.54 | 25 / 7 | |
| 1.0.53 | 25 / 7 |
v1.0.1073
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.1066
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.1052
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.929
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.770
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.763
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.761
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.746
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.654
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.643
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.632
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.615
2 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (teambit-owner) than the most recent previously approved version (davidfirst) on 2025-05-07, but teambit-owner is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v1.0.611
2 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (teambit-owner) than the most recent previously approved version (davidfirst) on 2025-04-29, but teambit-owner is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v1.0.254
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.228
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.173
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.116
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.115
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.114
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.113
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.112
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.111
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.110
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.109
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.108
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.107
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.106
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.105
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.104
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.103
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.102
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.101
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.100
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.99
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.98
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.97
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.96
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.95
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.94
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.93
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.92
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.91
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.90
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.89
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.88
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.87
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.86
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.85
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.84
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.83
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.82
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.81
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.80
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.79
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.78
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.77
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.76
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.75
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.74
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.73
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.72
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.71
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.70
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.69
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.68
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.67
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.66
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.65
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.64
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.63
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.62
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.61
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.60
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.59
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.58
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.57
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.56
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.55
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.54
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.53
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.