@tryghost/color-utils MIT 47 versions

@tryghost/color-utils

npm Repository Homepage

`npm install @tryghost/color-utils --save`

47

Versions

MIT

License

No

Install Scripts

Verified

Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures gitHead linked

Maintainers

zimoatghostallouiskernalghostchrisraibleerisdsjohnonolankevinansfieldcobbspuraileencgnjlohminimaluminiumsam-lordpauladamdavisbobvaneckjoeegrigghadretjonhickmanerik-ghostsagzyvershwalmike182ukluissazevedolsingernickmoretonrenatoworksrblstr-ghostevanhahn-ghostweylandswartghost-slimertmciescojonatan-ghost9larsons

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
provenance	publisher-changed	AI (provenance): Ghost Foundation migrated publishing to GitHub Actions CI with SLSA attestation; stable pattern for this org.	ai	2026/05/04
maintainer-change	maintainer-added	AI (maintainer-change): New maintainers are Ghost Foundation employees (ghost-suffixed accounts); legitimate org roster change.	ai	2026/05/04
maintainer-change	maintainer-removed	AI (maintainer-change): Removal of ibalosh consistent with org-level maintainer rotation, not a takeover signal.	ai	2026/05/04
phantom-deps	phantom-dep:@types/color	AI (phantom-deps): @types/color is a type declaration package; not directly imported at runtime by convention.	ai	2026/05/04

Versions (showing 47 of 47)

Version	Deps	Published
0.2.19	2 / 11	2026-06-08
0.2.18	2 / 11	2026-05-12
0.2.17	2 / 11	2026-04-27
0.2.16	2 / 11	2026-03-18
0.2.15	2 / 11	2026-02-26
0.2.14	2 / 11	2026-02-26
0.2.13	2 / 10	2026-01-12
0.2.12	2 / 10	2025-11-19
0.2.10	2 / 10	2025-07-22
0.2.9	2 / 10	2025-07-08
0.2.8	2 / 10	2025-07-03
0.2.7	2 / 10	2025-06-25
0.2.6	2 / 10	2025-05-25
0.2.5	2 / 10	2025-05-12
0.2.4	2 / 10	2025-05-12
0.2.3	2 / 10	2025-04-16
0.2.2	2 / 10	2024-04-25
0.2.1	2 / 10	2023-11-15
0.2.0	2 / 10	2023-10-30
0.1.27	1 / 9	2023-07-19
0.1.26	1 / 9	2023-05-08
0.1.25	1 / 9	2023-04-12
0.1.24	1 / 9	2023-03-15
0.1.23	1 / 9	2023-03-09
0.1.22	1 / 9	2022-11-29
0.1.21	1 / 9	2022-09-06
0.1.20	1 / 9	2022-08-05
0.1.19	1 / 9	2022-06-01
0.1.18	1 / 9	2022-05-27
0.1.17	1 / 9	2022-05-16
0.1.16	1 / 9	2022-05-10
0.1.15	1 / 9	2022-05-09
0.1.14	1 / 9	2022-05-05
0.1.13	1 / 9	2022-04-18
0.1.12	1 / 9	2022-03-15
0.1.11	1 / 9	2022-03-11
0.1.10	1 / 9	2022-03-07
0.1.9	1 / 9	2022-03-04
0.1.8	1 / 9	2022-02-23
0.1.7	1 / 9	2022-01-30
0.1.6	1 / 9	2022-01-20
0.1.5	1 / 9	2021-11-15
0.1.4	1 / 9	2021-11-09
0.1.3	1 / 9	2021-11-08
0.1.2	1 / 9	2021-09-01
0.1.1	1 / 9	2021-08-04
0.1.0	1 / 9	2021-07-29

v0.2.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.2.2

2 findings

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: binary-koan → mike182uk (on 2024-04-25, known maintainer) provenance

This version was published by a different npm account (mike182uk) than the most recent previously approved version (binary-koan) on 2024-04-25, but mike182uk is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

v0.2.1

2 findings

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: binary-koan → 9larsons (on 2023-11-15, known maintainer) provenance

This version was published by a different npm account (9larsons) than the most recent previously approved version (binary-koan) on 2023-11-15, but 9larsons is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

v0.2.0

2 findings

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: daniellockyer → binary-koan (on 2023-10-30, known maintainer) provenance

This version was published by a different npm account (binary-koan) than the most recent previously approved version (daniellockyer) on 2023-10-30, but binary-koan is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

v0.1.27

2 findings

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: daniellockyer → gargol (on 2023-07-19, known maintainer) provenance

This version was published by a different npm account (gargol) than the most recent previously approved version (daniellockyer) on 2023-07-19, but gargol is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

v0.1.26

2 findings

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: kevinansfield → daniellockyer (on 2023-05-08, known maintainer) provenance

This version was published by a different npm account (daniellockyer) than the most recent previously approved version (kevinansfield) on 2023-05-08, but daniellockyer is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

v0.1.25

2 findings

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: daniellockyer → gargol (on 2023-04-12, known maintainer) provenance

This version was published by a different npm account (gargol) than the most recent previously approved version (daniellockyer) on 2023-04-12, but gargol is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

v0.1.24

2 findings

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: daniellockyer → kevinansfield (on 2023-03-15, known maintainer) provenance

This version was published by a different npm account (kevinansfield) than the most recent previously approved version (daniellockyer) on 2023-03-15, but kevinansfield is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

v0.1.23

2 findings

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: simonbackx → daniellockyer (on 2023-03-09, known maintainer) provenance

This version was published by a different npm account (daniellockyer) than the most recent previously approved version (simonbackx) on 2023-03-09, but daniellockyer is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

v0.1.22

2 findings

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: simonbackx → kevinansfield (on 2022-11-29, known maintainer) provenance

This version was published by a different npm account (kevinansfield) than the most recent previously approved version (simonbackx) on 2022-11-29, but kevinansfield is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

v0.1.21

2 findings

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: gargol → simonbackx (on 2022-09-06, known maintainer) provenance

This version was published by a different npm account (simonbackx) than the most recent previously approved version (gargol) on 2022-09-06, but simonbackx is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

v0.1.20

2 findings

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: gargol → rishabhgrg (on 2022-08-05, known maintainer) provenance

This version was published by a different npm account (rishabhgrg) than the most recent previously approved version (gargol) on 2022-08-05, but rishabhgrg is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

v0.1.19

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.1.18

2 findings

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: gargol → erisds (on 2022-05-27, known maintainer) provenance

This version was published by a different npm account (erisds) than the most recent previously approved version (gargol) on 2022-05-27, but erisds is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

v0.1.17

2 findings

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: simonbackx → gargol (on 2022-05-16, known maintainer) provenance

This version was published by a different npm account (gargol) than the most recent previously approved version (simonbackx) on 2022-05-16, but gargol is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

v0.1.16

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.1.15

2 findings

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: gargol → simonbackx (on 2022-05-09, known maintainer) provenance

This version was published by a different npm account (simonbackx) than the most recent previously approved version (gargol) on 2022-05-09, but simonbackx is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

v0.1.14

2 findings

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: gargol → erisds (on 2022-05-05, known maintainer) provenance

This version was published by a different npm account (erisds) than the most recent previously approved version (gargol) on 2022-05-05, but erisds is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

v0.1.13

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.1.12

2 findings

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: gargol → rishabhgrg (on 2022-03-15, known maintainer) provenance

This version was published by a different npm account (rishabhgrg) than the most recent previously approved version (gargol) on 2022-03-15, but rishabhgrg is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

v0.1.11

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.1.10

2 findings

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: gargol → allouis (on 2022-03-07, known maintainer) provenance

This version was published by a different npm account (allouis) than the most recent previously approved version (gargol) on 2022-03-07, but allouis is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

v0.1.9

2 findings

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: allouis → gargol (on 2022-03-04, known maintainer) provenance

This version was published by a different npm account (gargol) than the most recent previously approved version (allouis) on 2022-03-04, but gargol is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

v0.1.8

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.1.7

2 findings

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: rishabhgrg → allouis (on 2022-01-30, known maintainer) provenance

This version was published by a different npm account (allouis) than the most recent previously approved version (rishabhgrg) on 2022-01-30, but allouis is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

v0.1.6

2 findings

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: rishabhgrg → allouis (on 2022-01-20, known maintainer) provenance

This version was published by a different npm account (allouis) than the most recent previously approved version (rishabhgrg) on 2022-01-20, but allouis is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

v0.1.5

2 findings

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: kevinansfield → rishabhgrg (on 2021-11-15, known maintainer) provenance

This version was published by a different npm account (rishabhgrg) than the most recent previously approved version (kevinansfield) on 2021-11-15, but rishabhgrg is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

v0.1.4

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.1.3

2 findings

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: gargol → kevinansfield (on 2021-11-08, known maintainer) provenance

This version was published by a different npm account (kevinansfield) than the most recent previously approved version (gargol) on 2021-11-08, but kevinansfield is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

v0.1.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.1.1

2 findings

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: kevinansfield → gargol (on 2021-08-04, known maintainer) provenance

This version was published by a different npm account (gargol) than the most recent previously approved version (kevinansfield) on 2021-08-04, but gargol is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

v0.1.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.