@tmlmobilidade/fastify
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| publish-pattern | rapid-publish | AI (publish-pattern): High-frequency automated publishing is the norm for this org (~1.3 releases/day); rapid publish is expected, not suspicious. | ai | |
| phantom-deps | phantom-dep:pino | AI (phantom-deps): pino is a declared runtime dep used via config/logger setup; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:pino-pretty | AI (phantom-deps): pino-pretty is a declared runtime dep used via config; stable false positive for this package. | ai | |
| npm-metadata | no-description | AI (npm-metadata): Org monorepo package; consistently missing description across versions, not a malware indicator here. | ai | |
| provenance | no-provenance | AI (provenance): Publisher has 881 approved packages without provenance; stable pattern for this org. | ai | |
| dependencies | unvetted-dep:@tmlmobilidade/consts | AI (dependencies): Internal org dependency; consistent with this package's established publishing pattern. | ai | |
| dependencies | unvetted-dep:@fastify/one-line-logger | AI (dependencies): Official @fastify scoped package; low risk, stable dependency. | ai | |
| dependencies | unvetted-dep:@tmlmobilidade/interfaces | AI (dependencies): Internal org dependency; consistent with this package's established publishing pattern. | ai | |
| dependencies | unvetted-dep:@tmlmobilidade/utils | AI (dependencies): Internal org dependency; consistent with this package's established publishing pattern. | ai |
Versions (showing 15 of 15)
| Version | Deps | Published |
|---|---|---|
| 20260605.149.34 | 8 / 6 | |
| 20260601.1808.3 | 8 / 6 | |
| 20260527.947.18 | 8 / 6 | |
| 20260526.1648.32 | 8 / 6 | |
| 20260525.1751.19 | 8 / 6 | |
| 20260525.1615.59 | 8 / 6 | |
| 20260518.901.35 | 8 / 6 | |
| 20260518.827.12 | 8 / 6 | |
| 20260509.331.19 | 8 / 6 | |
| 20260508.1103.58 | 8 / 6 | |
| 20260504.1217.59 | 8 / 6 | |
| 20260504.1029.41 | 8 / 6 | |
| 20260429.1713.40 | 8 / 6 | |
| 20260208.202.18 | 10 / 6 | |
| 20251202.1817.5 | 10 / 6 |
v20260605.149.34
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v20260601.1808.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v20260527.947.18
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (joaovasconcelos) than the most recent previously approved version (jusimen) on 2026-05-27, but joaovasconcelos is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v20260526.1648.32
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v20260525.1751.19
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v20260525.1615.59
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v20260518.901.35
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v20260518.827.12
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v20260509.331.19
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v20260508.1103.58
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v20260504.1217.59
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v20260504.1029.41
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v20260429.1713.40
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v20260208.202.18
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v20251202.1817.5
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.