@things-factory/integration-marketplace
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| bogus-package | bogus-package | AI (bogus-package): README link dump and no keywords are cosmetic; package is a legitimate long-lived @things-factory module. | ai | |
| phantom-deps | phantom-dep:@things-factory/auth-ui | AI (phantom-deps): Same-org monorepo dep; phantom-dep heuristic is a stable false positive here. | ai | |
| phantom-deps | phantom-dep:@things-factory/code-ui | AI (phantom-deps): Same-org monorepo dep; stable false positive. | ai | |
| phantom-deps | phantom-dep:@things-factory/more-ui | AI (phantom-deps): Same-org monorepo dep; stable false positive. | ai | |
| phantom-deps | phantom-dep:@things-factory/biz-base | AI (phantom-deps): Same-org monorepo dep; stable false positive. | ai | |
| phantom-deps | phantom-dep:@things-factory/system-ui | AI (phantom-deps): Same-org monorepo dep; stable false positive. | ai | |
| phantom-deps | phantom-dep:@things-factory/context-ui | AI (phantom-deps): Same-org monorepo dep; stable false positive. | ai | |
| phantom-deps | phantom-dep:@things-factory/setting-ui | AI (phantom-deps): Same-org monorepo dep; stable false positive. | ai | |
| phantom-deps | phantom-dep:@things-factory/resource-ui | AI (phantom-deps): Same-org monorepo dep; stable false positive. | ai | |
| phantom-deps | phantom-dep:@things-factory/integration-ui | AI (phantom-deps): Same-org monorepo dep; stable false positive. | ai | |
| phantom-deps | phantom-dep:@things-factory/apptool-ui | AI (phantom-deps): Same-org monorepo dep; stable false positive. | ai | |
| semgrep | semgrep:dynamic-require | AI (semgrep): Dynamic require in migrations/index.js is a standard migration-loader pattern; stable false positive for this package. | ai |
Versions (showing 51 of 79)
| Version | Deps | Published |
|---|---|---|
| 9.2.33 | 14 / 8 | |
| 9.2.31 | 14 / 8 | |
| 9.2.30 | 14 / 8 | |
| 9.2.29 | 14 / 8 | |
| 9.2.28 | 14 / 8 | |
| 9.2.27 | 14 / 8 | |
| 9.2.25 | 14 / 8 | |
| 9.2.24 | 14 / 8 | |
| 9.2.23 | 14 / 8 | |
| 9.2.22 | 14 / 8 | |
| 9.2.21 | 14 / 8 | |
| 9.2.20 | 14 / 8 | |
| 9.2.18 | 14 / 8 | |
| 8.0.75 | 14 / 8 | |
| 6.4.8 | 15 / 8 | |
| 4.3.824 | 16 / 8 | |
| 4.3.823 | 16 / 8 | |
| 4.3.798 | 16 / 8 | |
| 4.3.790 | 16 / 8 | |
| 4.3.755 | 16 / 8 | |
| 4.3.752 | 16 / 8 | |
| 4.3.740 | 16 / 8 | |
| 4.3.734 | 16 / 8 | |
| 4.3.729 | 16 / 8 | |
| 4.3.686 | 16 / 8 | |
| 4.3.685 | 16 / 8 | |
| 4.3.684 | 16 / 8 | |
| 4.3.683 | 16 / 8 | |
| 4.3.682 | 16 / 8 | |
| 4.3.681 | 16 / 8 | |
| 4.3.677 | 16 / 8 | |
| 4.3.675 | 16 / 8 | |
| 4.3.673 | 16 / 8 | |
| 4.3.671 | 16 / 8 | |
| 4.3.669 | 16 / 8 | |
| 4.3.660 | 16 / 8 | |
| 4.3.656 | 16 / 8 | |
| 4.3.653 | 16 / 8 | |
| 4.3.652 | 16 / 8 | |
| 4.3.647 | 16 / 8 | |
| 4.3.642 | 16 / 8 | |
| 4.3.639 | 16 / 8 | |
| 4.3.638 | 16 / 8 | |
| 4.3.637 | 16 / 8 | |
| 4.3.617 | 16 / 8 | |
| 4.3.616 | 16 / 8 | |
| 4.3.614 | 16 / 8 | |
| 4.3.609 | 16 / 8 | |
| 4.3.595 | 16 / 8 | |
| 4.3.591 | 16 / 8 | |
| 4.3.587 | 16 / 8 |
v9.2.33
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.2.31
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.3.617
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.3.616
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.3.614
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.3.609
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.3.595
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.3.591
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.3.587
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.