@teambit/doctor — Greenflagged

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures No source commit

Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.

Maintainers

teambit-ownershohamgiladdavidfirstranm8guysaaritaymendelerezbitjoshk2redigmayona007

Keywords

bitbit-aspectbit-core-aspectcomponentscollaborationweb

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
npm-metadata	no-description	AI (npm-metadata): Monorepo package with stable release history; description gap is benign.	ai	2026/04/30
provenance	no-provenance	AI (provenance): Established package; provenance absence is not a disqualifier for internal monorepo releases.	ai	2026/04/30
dependencies	unvetted-dep:@teambit/bvm.list	AI (dependencies): First-party @teambit org dependency; stable pattern across all versions of this package.	ai	2026/04/30
dependencies	unvetted-dep:@teambit/bit-error	AI (dependencies): First-party @teambit org dependency; stable pattern across all versions of this package.	ai	2026/04/30
dependencies	unvetted-dep:@teambit/component-id	AI (dependencies): First-party @teambit org dependency; stable pattern across all versions of this package.	ai	2026/04/30
dependencies	unvetted-dep:@teambit/legacy.scope	AI (dependencies): First-party @teambit org dependency; stable pattern across all versions of this package.	ai	2026/04/30
dependencies	unvetted-dep:@teambit/legacy.utils	AI (dependencies): First-party @teambit org dependency; stable pattern across all versions of this package.	ai	2026/04/30
dependencies	unvetted-dep:@teambit/legacy.logger	AI (dependencies): First-party @teambit org dependency; stable pattern across all versions of this package.	ai	2026/04/30
dependencies	unvetted-dep:@teambit/scope.network	AI (dependencies): First-party @teambit org dependency; stable pattern across all versions of this package.	ai	2026/04/30
dependencies	unvetted-dep:@teambit/scope.remotes	AI (dependencies): First-party @teambit org dependency; stable pattern across all versions of this package.	ai	2026/04/30
dependencies	unvetted-dep:@teambit/legacy.bit-map	AI (dependencies): First-party @teambit org dependency; stable pattern across all versions of this package.	ai	2026/04/30
dependencies	unvetted-dep:@teambit/legacy.consumer	AI (dependencies): First-party @teambit org dependency; stable pattern across all versions of this package.	ai	2026/04/30
dependencies	unvetted-dep:@teambit/legacy.constants	AI (dependencies): First-party @teambit org dependency; stable pattern across all versions of this package.	ai	2026/04/30
dependencies	unvetted-dep:@teambit/bit.get-bit-version	AI (dependencies): First-party @teambit org dependency; stable pattern across all versions of this package.	ai	2026/04/30
dependencies	unvetted-dep:@teambit/legacy.consumer-config	AI (dependencies): First-party @teambit org dependency; stable pattern across all versions of this package.	ai	2026/04/30
dependencies	unvetted-dep:@teambit/git.modules.git-executable	AI (dependencies): First-party @teambit org dependency; stable pattern across all versions of this package.	ai	2026/04/30
dependencies	unvetted-dep:@teambit/toolbox.fs.extension-getter	AI (dependencies): First-party @teambit org dependency; stable pattern across all versions of this package.	ai	2026/04/30
dependencies	unvetted-dep:@teambit/scope.modules.find-scope-path	AI (dependencies): First-party @teambit org dependency; stable pattern across all versions of this package.	ai	2026/04/30
dependencies	unvetted-dep:@teambit/workspace.modules.workspace-locator	AI (dependencies): First-party @teambit org dependency; stable pattern across all versions of this package.	ai	2026/04/30
dependencies	unvetted-dep:@teambit/harmony	AI (dependencies): First-party @teambit org dependency; stable pattern across all versions of this package.	ai	2026/04/30
phantom-deps	phantom-dep:@teambit/scope.network	AI (phantom-deps): Same-org internal dep in a large monorepo; phantom detection is a heuristic false positive here.	ai	2026/04/29

Versions (showing 5 of 5)

Version	Deps	Published
0.0.675	34 / 4	2026-05-18
0.0.657	34 / 4	2026-04-30
0.0.656	34 / 4	2026-04-30
0.0.655	34 / 4	2026-04-29
0.0.653	34 / 4	2026-04-28

v0.0.675

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.657

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.656

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.655

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.