@things-factory/auth-base
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| phantom-deps | phantom-dep:passport | AI (phantom-deps): passport is a declared dep used transitively via koa-passport; phantom-dep is a false positive here. | ai | |
| phantom-deps | phantom-dep:@types/webappsec-credential-management | AI (phantom-deps): Type-only package; not imported at runtime, stable false positive. | ai | |
| phantom-deps | phantom-dep:@simplewebauthn/browser | AI (phantom-deps): Browser-side dep declared for bundling; not directly imported server-side by design. | ai | |
| phantom-deps | phantom-dep:@things-factory/i18n-base | AI (phantom-deps): Same-org dep declared but not directly imported; likely used transitively or for side-effects. Not a risk. | ai | |
| semgrep | semgrep:base64-decode | AI (semgrep): Standard WebAuthn credential public key decoding; not a payload-hiding pattern. | ai | |
| semgrep | semgrep:dynamic-require | AI (semgrep): Loads local migration files from a resolved filesystem path; not arbitrary module loading. | ai | |
| semgrep | semgrep:hex-decode | AI (semgrep): AES-256-CBC IV/ciphertext decoding in a crypto utility; legitimate use. | ai |
Versions (showing 18 of 18)
| Version | Deps | Published |
|---|---|---|
| 9.2.24 | 16 / 0 | |
| 9.2.16 | 16 / 0 | |
| 9.2.5 | 16 / 0 | |
| 9.1.19 | 16 / 0 | |
| 9.0.34 | 16 / 0 | |
| 9.0.25 | 16 / 0 | |
| 9.0.24 | 16 / 0 | |
| 9.0.5 | 16 / 0 | |
| 8.0.88 | 15 / 0 | |
| 8.0.86 | 15 / 0 | |
| 8.0.63 | 15 / 0 | |
| 4.3.815 | 13 / 0 | |
| 4.3.767 | 13 / 0 | |
| 4.3.752 | 13 / 0 | |
| 4.3.738 | 13 / 0 | |
| 4.3.729 | 13 / 0 | |
| 4.3.727 | 13 / 0 | |
| 4.3.723 | 13 / 0 |
v9.2.24
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v9.2.16
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v9.2.5
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v9.1.19
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v9.0.34
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v9.0.25
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v9.0.24
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v9.0.5
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v8.0.88
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v8.0.86
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v8.0.63
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.3.815
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.3.767
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.3.752
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.3.738
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.3.729
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.3.727
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.3.723
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.