@teambit/snapping — Greenflagged

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures No source commit

Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.

Maintainers

teambit-ownershohamgiladdavidfirstranm8guysaaritaymendelerezbitjoshk2redigmayona007

Keywords

bitbit-aspectbit-core-aspectcomponentscollaborationweb

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
dependencies	unvetted-dep:@teambit/toolbox.promise.map-pool	AI (dependencies): Internal @teambit org dependency; consistent with this package's established publishing pattern.	ai	2026/04/30
dependencies	unvetted-dep:@teambit/lanes.modules.create-lane	AI (dependencies): Internal @teambit org dependency; consistent with this package's established publishing pattern.	ai	2026/04/30
dependencies	unvetted-dep:@teambit/legacy.consumer-component	AI (dependencies): Internal @teambit org dependency; consistent with this package's established publishing pattern.	ai	2026/04/30
dependencies	unvetted-dep:@teambit/pkg.modules.semver-helper	AI (dependencies): Internal @teambit org dependency; consistent with this package's established publishing pattern.	ai	2026/04/30
dependencies	unvetted-dep:@teambit/harmony.modules.concurrency	AI (dependencies): Internal @teambit org dependency; consistent with this package's established publishing pattern.	ai	2026/04/30
dependencies	unvetted-dep:@teambit/harmony.modules.get-basic-log	AI (dependencies): Internal @teambit org dependency; consistent with this package's established publishing pattern.	ai	2026/04/30
dependencies	unvetted-dep:@teambit/legacy.dependency-graph	AI (dependencies): Internal @teambit monorepo dependency; same org as this package.	ai	2026/04/30
dependencies	unvetted-dep:@teambit/legacy.component-list	AI (dependencies): Internal @teambit monorepo dependency; same org as this package.	ai	2026/04/30
dependencies	unvetted-dep:@teambit/legacy.extension-data	AI (dependencies): Internal @teambit monorepo dependency; same org as this package.	ai	2026/04/30
dependencies	unvetted-dep:@teambit/legacy.consumer-config	AI (dependencies): Internal @teambit monorepo dependency; same org as this package.	ai	2026/04/30
dependencies	unvetted-dep:@teambit/harmony	AI (dependencies): Internal @teambit monorepo dependency; same org as this package.	ai	2026/04/30
dependencies	unvetted-dep:@teambit/lane-id	AI (dependencies): Internal @teambit monorepo dependency; same org as this package.	ai	2026/04/30
dependencies	unvetted-dep:@teambit/bit-error	AI (dependencies): Internal @teambit monorepo dependency; same org as this package.	ai	2026/04/30
dependencies	unvetted-dep:@teambit/component-id	AI (dependencies): Internal @teambit monorepo dependency; same org as this package.	ai	2026/04/30
dependencies	unvetted-dep:@teambit/legacy.scope	AI (dependencies): Internal @teambit monorepo dependency; same org as this package.	ai	2026/04/30
dependencies	unvetted-dep:@teambit/legacy-bit-id	AI (dependencies): Internal @teambit monorepo dependency; same org as this package.	ai	2026/04/30
dependencies	unvetted-dep:@teambit/legacy.loader	AI (dependencies): Internal @teambit monorepo dependency; same org as this package.	ai	2026/04/30
dependencies	unvetted-dep:@teambit/legacy.logger	AI (dependencies): Internal @teambit monorepo dependency; same org as this package.	ai	2026/04/30
dependencies	unvetted-dep:@teambit/legacy.consumer	AI (dependencies): Internal @teambit monorepo dependency; same org as this package.	ai	2026/04/30
dependencies	unvetted-dep:@teambit/component-issues	AI (dependencies): Internal @teambit monorepo dependency; same org as this package.	ai	2026/04/30
dependencies	unvetted-dep:@teambit/graph.cleargraph	AI (dependencies): Internal @teambit monorepo dependency; same org as this package.	ai	2026/04/30
dependencies	unvetted-dep:@teambit/legacy.constants	AI (dependencies): Internal @teambit monorepo dependency; same org as this package.	ai	2026/04/30
dependencies	unvetted-dep:@teambit/legacy.scope-api	AI (dependencies): Internal @teambit monorepo dependency; same org as this package.	ai	2026/04/30
dependencies	unvetted-dep:@teambit/component-version	AI (dependencies): Internal @teambit monorepo dependency; same org as this package.	ai	2026/04/30
dependencies	unvetted-dep:@teambit/component.sources	AI (dependencies): Internal @teambit monorepo dependency; same org as this package.	ai	2026/04/30
dependencies	unvetted-dep:@teambit/toolbox.crypto.sha1	AI (dependencies): Internal @teambit monorepo dependency; same org as this package.	ai	2026/04/30
npm-metadata	no-description	AI (npm-metadata): Teambit packages consistently omit npm description; not a malware indicator here.	ai	2026/04/29
phantom-deps	phantom-dep:@teambit/legacy-bit-id	AI (phantom-deps): Same-org internal dep; phantom-dep heuristic unreliable for monorepo packages.	ai	2026/04/29
provenance	no-provenance	AI (provenance): Established teambit monorepo package; no provenance is consistent across all 2287 versions.	ai	2026/04/29

Versions (showing 5 of 5)

Version	Deps	Published
1.0.990	52 / 12	2026-05-18
1.0.972	52 / 12	2026-04-30
1.0.971	52 / 12	2026-04-30
1.0.970	52 / 12	2026-04-29
1.0.968	52 / 12	2026-04-28

v1.0.990

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.0.972

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.0.971

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.0.970

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.