@things-factory/worksheet-base
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| semgrep | semgrep:dynamic-require | AI (semgrep): Migration file loader pattern — requires files from a local directory, not user-controlled input. | ai | |
| semgrep | semgrep:base64-decode | AI (semgrep): Decodes AWS Lambda LogResult response — standard AWS SDK usage, not obfuscation. | ai | |
| phantom-deps | phantom-dep:@things-factory/worksheet-ui | AI (phantom-deps): Same-org monorepo dep; may be used transitively or in client bundle not scanned. | ai | |
| phantom-deps | phantom-dep:@things-factory/document-template-base | AI (phantom-deps): Same-org monorepo dep; phantom-dep heuristic unreliable for monorepo packages. | ai |
Versions (showing 8 of 8)
| Version | Deps | Published |
|---|---|---|
| 4.3.822 | 22 / 0 | |
| 4.3.667 | 21 / 0 | |
| 4.3.651 | 21 / 0 | |
| 4.3.648 | 21 / 0 | |
| 4.3.647 | 21 / 0 | |
| 4.3.646 | 21 / 0 | |
| 4.3.644 | 21 / 0 | |
| 4.3.639 | 21 / 0 |
v4.3.822
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.3.667
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.3.651
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.3.648
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.3.647
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.3.646
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.3.644
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.3.639
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.