@tmlmobilidade/emails
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| publish-pattern | rapid-publish | AI (publish-pattern): 815 versions with date-stamped versioning indicates automated CI/CD; rapid publish is expected behavior for this package. | ai | |
| phantom-deps | phantom-dep:browserslist | AI (phantom-deps): browserslist is a build-time config dep, not directly imported in source. | ai | |
| phantom-deps | phantom-dep:@types/nodemailer | AI (phantom-deps): Type-only package loaded by TypeScript convention, not directly imported. | ai | |
| dependencies | unvetted-dep:@tmlmobilidade/dates | AI (dependencies): Same-org internal dependency; consistent pattern across all @tmlmobilidade/* packages. | ai | |
| provenance | no-provenance | AI (provenance): No provenance across this org's packages; stable false positive for this publisher. | ai | |
| npm-metadata | no-description | AI (npm-metadata): Intentional internal package; missing description is consistent across the org's packages. | ai | |
| phantom-deps | phantom-dep:react-email | AI (phantom-deps): react-email is a declared runtime dep used as a dev/CLI tool; phantom detection is a false positive for this package. | ai |
Versions (showing 36 of 36)
| Version | Deps | Published |
|---|---|---|
| 20260724.1738.47 | 6 / 7 | |
| 20260719.2303.27 | 6 / 7 | |
| 20260717.1321.32 | 6 / 7 | |
| 20260713.1740.11 | 6 / 7 | |
| 20260710.2210.9 | 6 / 7 | |
| 20260627.1155.27 | 6 / 7 | |
| 20260618.507.0 | 6 / 7 | |
| 20260616.229.43 | 6 / 7 | |
| 20260611.1651.27 | 6 / 7 | |
| 20260609.1128.18 | 6 / 7 | |
| 20260607.1318.3 | 6 / 7 | |
| 20260604.2309.43 | 6 / 7 | |
| 20260525.1830.15 | 6 / 7 | |
| 20260525.1615.59 | 6 / 7 | |
| 20260525.1614.32 | 6 / 7 | |
| 20260518.901.35 | 6 / 7 | |
| 20260518.827.12 | 6 / 7 | |
| 20260507.2220.24 | 6 / 7 | |
| 20260507.1757.50 | 6 / 7 | |
| 20260504.1217.59 | 6 / 7 | |
| 20260429.1713.40 | 7 / 7 | |
| 20260418.1237.24 | 7 / 7 | |
| 20260410.1133.41 | 8 / 6 | |
| 20260409.1552.16 | 8 / 6 | |
| 20260331.1620.53 | 8 / 6 | |
| 20260329.1522.22 | 8 / 6 | |
| 20260326.2207.53 | 8 / 6 | |
| 20260326.1644.50 | 8 / 6 | |
| 20260326.219.51 | 8 / 6 | |
| 20260324.1220.16 | 8 / 6 | |
| 20260323.400.54 | 8 / 6 | |
| 20260316.1439.45 | 8 / 6 | |
| 20260225.1312.4 | 10 / 6 | |
| 20260222.2136.56 | 10 / 6 | |
| 20260216.1613.20 | 10 / 6 | |
| 20260130.1104.56 | 10 / 6 |
v20260724.1738.47
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v20260719.2303.27
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v20260717.1321.32
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v20260713.1740.11
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v20260710.2210.9
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v20260627.1155.27
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.