← Home

@tryghost/bookshelf-include-count

npm Repository

`npm install @tryghost/bookshelf-include-count --save`

24
Versions
MIT
License
No
Install Scripts
Verified
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures No source commit

Maintainers

zimoatghostallouiskernalghostchrisraibleerisdsjohnonolankevinansfieldcobbspuraileencgnjlohminimaluminiumsam-lordpauladamdavisbobvaneckjoeegrigghadretjonhickmanerik-ghostsagzyvershwalzach1618mike182ukluissazevedolsingernickmoretonrenatoworksrblstr-ghostevanhahn-ghostaustin.burdineweylandswartghost-slimertmciescojonatan-ghost9larsons

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
provenance missing-githead AI (provenance): SLSA provenance attestation present; gitHead absence reflects CI pipeline change, not tampering. ai
bogus-package bogus-package AI (bogus-package): Established Ghost Framework utility; empty main/no-description are stable characteristics of this package. ai
npm-metadata no-description AI (npm-metadata): Long-standing Ghost package; missing description is a stable false positive. ai
provenance no-provenance AI (provenance): Ghost Framework monorepo packages consistently lack Sigstore provenance; stable false positive for this package family. ai
dependencies unvetted-dep:@tryghost/debug AI (dependencies): First-party Ghost Foundation package; stable false positive for this ecosystem. ai

Versions (showing 24 of 24)

Version Deps Published
2.3.5 2 / 1
2.3.4 2 / 1
2.3.3 2 / 1
2.3.2 2 / 1
2.3.1 2 / 1
2.3.0 2 / 1
2.2.3 2 / 1
2.2.2 2 / 1
2.2.1 2 / 1
2.2.0 2 / 1
2.1.0 2 / 1
2.0.3 2 / 1
2.0.2 2 / 1
2.0.1 2 / 1
2.0.0 2 / 3
1.2.1 2 / 3
1.2.0 2 / 3
1.1.0 2 / 3
1.0.0 2 / 3
0.3.23 2 / 3
0.3.22 2 / 3
0.3.21 2 / 3
0.3.20 2 / 3
0.3.19 2 / 3

v2.3.5

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v2.3.4

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v2.3.3

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v2.3.2

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.