← Home

@tego/core

npm Repository Homepage
9
Versions
—
License
No
Install Scripts
Attested
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation (unverified) npm registry signatures No source commit

Maintainers

tomyjansealday

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
typosquat typosquat.levenshtein:cors AI (typosquat): @tego/core is a scoped package in the tegojs org; not a typosquat of cors. ai
semgrep semgrep:shady-links-raw-ip AI (semgrep): 127.0.0.1 is localhost loopback used for local gateway; not an exfiltration endpoint. ai
semgrep semgrep:hex-decode AI (semgrep): AES-256-CBC decryption using hex IV/ciphertext is standard crypto usage, not obfuscation. ai
semgrep semgrep:api-obfuscation-reflect AI (semgrep): Reflect.get in a Proxy trap is idiomatic JS; not evasion. ai
semgrep semgrep:dynamic-require AI (semgrep): Dynamic require loads a locally-written watchId file; not arbitrary user input. ai

Versions (showing 9 of 9)

Version Deps Published
1.6.16 39 / 11
1.6.15 39 / 11
1.6.14 39 / 11
1.6.13 39 / 11
1.6.12 38 / 11
1.6.11 38 / 11
1.6.10 38 / 11
1.6.9 38 / 11
1.6.3 38 / 11

v1.6.16

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.6.15

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.6.14

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.