← Home

@things-factory/kpi

npm Repository

kpi module

11
Versions
MIT
License
No
Install Scripts
Missing
Provenance

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.

Maintainers

woo_ramjyp220heartyohhorwengliang95nalshya113shortstopyoungwookwengliang95

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
typosquat typosquat.levenshtein:koa AI (typosquat): Scoped package @things-factory/kpi; no plausible typosquat of koa. ai
typosquat typosquat.levenshtein:hapi AI (typosquat): Scoped package @things-factory/kpi; no plausible typosquat of hapi. ai
typosquat typosquat.levenshtein:pg AI (typosquat): Scoped package @things-factory/kpi; no plausible typosquat of pg. ai
typosquat typosquat.levenshtein:joi AI (typosquat): Scoped package @things-factory/kpi; no plausible typosquat of joi. ai
semgrep semgrep:dynamic-require AI (semgrep): Standard migration-file loader pattern; resolves files from a known directory, not user input. ai

Versions (showing 11 of 11)

Version Deps Published
9.2.33 16 / 0
9.2.32 16 / 0
9.2.31 16 / 0
9.2.30 16 / 0
9.2.29 16 / 0
9.2.28 16 / 0
9.2.27 16 / 0
9.2.26 16 / 0
9.2.25 16 / 0
9.2.19 16 / 0
9.2.13 16 / 0

v9.2.33

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v9.2.32

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v9.2.31

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.