@tensorflow/tfjs-core
Hardware-accelerated JavaScript library for machine intelligence
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| phantom-deps | phantom-dep:@types/long | AI (phantom-deps): Type-only devtime package, benign for this framework. | ai | |
| phantom-deps | phantom-dep:@webgpu/types | AI (phantom-deps): Config-referenced type package, benign. | ai | |
| phantom-deps | phantom-dep:@types/seedrandom | AI (phantom-deps): Type-only package, benign. | ai | |
| phantom-deps | phantom-dep:@types/offscreencanvas | AI (phantom-deps): Type-only package, benign. | ai | |
| provenance | no-provenance | AI (provenance): Verified authentic tfjs-core (downloads/age/repo/edges all consistent); missing provenance is not impersonation. | ai |
Versions (showing 4 of 4)
| Version | Deps | Published |
|---|---|---|
| 4.22.0 | 7 / 2 | |
| 4.21.0 | 7 / 2 | |
| 4.20.0 | 7 / 2 | |
| 4.19.0 | 7 / 2 |
v4.22.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.21.0
1 finding[Reject — re-review on republish] (prior reject: AI (provenance): Official @tensorflow packages from Google carry provenance; absence here is consistent with impersonation and generalizes to all versions from this publisher.) Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.20.0
1 finding[Reject — re-review on republish] (prior reject: AI (provenance): Official @tensorflow packages from Google carry provenance; absence here is consistent with impersonation and generalizes to all versions from this publisher.) Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.19.0
1 finding[Reject — re-review on republish] (prior reject: AI (provenance): Official @tensorflow packages from Google carry provenance; absence here is consistent with impersonation and generalizes to all versions from this publisher.) Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.