← Home

@tinacms/app

npm Repository
55
Versions
Apache-2.0
License
No
Install Scripts
Verified
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures No source commit

Maintainers

wicksipediarobt-tina

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
provenance no-provenance AI (provenance): Established package; missing provenance is common and low-risk in this context. ai
dependencies unvetted-dep:@tinacms/mdx AI (dependencies): Sibling package in the tinacms monorepo; same publisher and trust chain. ai
bogus-package bogus-package AI (bogus-package): Internal monorepo sub-package; missing metadata is consistent across the @tinacms scope, not a spam indicator. ai
npm-metadata no-description AI (npm-metadata): Monorepo internal package; missing description is a stable characteristic, not a malice indicator. ai
typosquat typosquat.levenshtein:hapi AI (typosquat): Scoped @tinacms package in official monorepo; Levenshtein match against short unrelated name is a false positive. ai
phantom-deps phantom-dep:typescript AI (phantom-deps): typescript is a build-time tool referenced in tsconfig/build config; not imported at runtime. Stable false positive for this package. ai
typosquat typosquat.levenshtein:pg AI (typosquat): Scoped @tinacms package in official monorepo; Levenshtein match against short unrelated name is a false positive. ai
typosquat typosquat.levenshtein:yup AI (typosquat): Scoped @tinacms package in official monorepo; Levenshtein match against short unrelated name is a false positive. ai
typosquat typosquat.levenshtein:ajv AI (typosquat): Scoped @tinacms package in official monorepo; Levenshtein match against short unrelated name is a false positive. ai

Versions (showing 55 of 55)

Version Deps Published
2.5.10 15 / 6
2.5.9 15 / 6
2.5.8 15 / 6
2.5.7 15 / 6
2.5.6 15 / 6
2.5.5 15 / 3
2.5.4 15 / 3
2.5.3 15 / 3
2.5.2 15 / 3
2.5.1 15 / 3
2.5.0 15 / 3
2.4.8 15 / 3
2.4.7 15 / 3
2.4.6 15 / 3
2.4.5 15 / 3
2.4.4 15 / 3
2.4.3 15 / 3
2.4.2 15 / 3
2.4.1 15 / 3
2.4.0 15 / 3
2.3.30 15 / 3
2.3.29 15 / 3
2.3.28 15 / 3
2.3.27 15 / 3
2.3.26 15 / 3
2.3.25 15 / 3
2.3.24 15 / 3
2.3.23 15 / 3
2.3.22 15 / 3
2.3.21 15 / 3
2.3.20 15 / 3
2.3.19 15 / 3
2.3.18 15 / 3
2.3.17 15 / 3
2.3.16 15 / 3
2.3.15 15 / 3
2.3.14 15 / 3
2.3.13 15 / 3
2.3.12 15 / 3
2.3.11 15 / 3
2.3.10 15 / 3
2.3.9 15 / 3
2.3.8 15 / 3
2.3.7 15 / 3
2.3.5 15 / 3
2.3.4 15 / 3
2.3.3 15 / 3
2.3.2 15 / 3
2.3.1 15 / 3
2.3.0 15 / 3
2.2.10 13 / 3
2.2.9 13 / 3
2.2.8 13 / 3
2.2.7 13 / 3
2.2.6 15 / 3

v2.5.10

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v2.5.9

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v2.5.8

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v2.5.7

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.