@tmlmobilidade/export-data
CLI tool to export data from GO.
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| phantom-deps | phantom-dep:@tmlmobilidade/go-types-vehicle-events | AI (phantom-deps): Newly added same-org dependency; likely used transitively or in type definitions. | ai | |
| dependencies | unvetted-dep:@tmlmobilidade/go-performance-pckg-dates | AI (dependencies): First-party internal monorepo dependency, not third-party risk. | ai | |
| phantom-deps | phantom-dep:@tmlmobilidade/go-interfaces-godb | AI (phantom-deps): Same-org scope, not directly imported but expected monorepo pattern. | ai | |
| dependencies | unvetted-dep:@tmlmobilidade/go-interfaces-godb | AI (dependencies): Same-org monorepo dep, renamed sibling of previously accepted go-interfaces-go-db. | ai | |
| dependencies | unvetted-dep:@tmlmobilidade/go-interfaces-go-db | AI (dependencies): Same-org monorepo package, consistent with sibling deps already accepted. | ai | |
| phantom-deps | phantom-dep:@tmlmobilidade/go-interfaces-go-db | AI (phantom-deps): Same-org scope, likely used indirectly; consistent with other accepted phantom-dep findings. | ai | |
| license | copyleft-license:AGPL-3.0-or-later | AI (license): Declared AGPL license is intentional; stable for this package. | ai | |
| phantom-deps | phantom-dep:@tmlmobilidade/go-types-apex | AI (phantom-deps): Monorepo pattern; types likely re-exported transitively by other @tmlmobilidade deps. | ai | |
| phantom-deps | phantom-dep:@tmlmobilidade/types | AI (phantom-deps): Monorepo pattern; types likely re-exported transitively by other @tmlmobilidade deps. | ai | |
| provenance | no-provenance | AI (provenance): Common across npm; publisher has established track record. | ai | |
| phantom-deps | phantom-dep:@tmlmobilidade/timer | AI (phantom-deps): Same-org scoped package; declared as dependency, phantom-dep heuristic false positive for this package. | ai | |
| publish-pattern | rapid-publish | AI (publish-pattern): High-velocity CI-driven monorepo with 180 versions; rapid publishes are the norm for this package. | ai | |
| publish-pattern | new-deps-added | AI (publish-pattern): exceljs and @tmlmobilidade/logger are legitimate deps consistent with an export-data CLI tool; publisher has strong track record. | ai | |
| dependencies | unvetted-dep:@tmlmobilidade/dates | AI (dependencies): Internal sibling package from same org; consistent pattern across all @tmlmobilidade/* packages. | ai | |
| dependencies | unvetted-dep:@tmlmobilidade/interfaces | AI (dependencies): Internal sibling package from same org; consistent pattern across all @tmlmobilidade/* packages. | ai | |
| dependencies | unvetted-dep:@tmlmobilidade/consts | AI (dependencies): Internal sibling package from same org; consistent pattern across all @tmlmobilidade/* packages. | ai |
Versions (showing 51 of 139)
v20260726.1205.40
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v20260724.1737.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v20260723.2332.8
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v20260723.1538.18
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v20260717.1322.14
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v20260714.2327.43
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v20260713.1622.27
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v20260710.2240.24
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v20260709.1326.47
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v20260709.1318.42
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v20260707.1126.48
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v20260703.1528.13
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v20260703.1338.56
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v20260627.1247.25
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v20260627.1143.11
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.