@tryghost/helpers

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account (mike182uk) than the most recent previously approved version (9larsons) on 2024-04-25, but mike182uk is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account (9larsons) than the most recent previously approved version (binary-koan) on 2023-11-15, but 9larsons is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account (binary-koan) than the most recent previously approved version (gargol) on 2023-10-26, but binary-koan is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

This version was published by a different npm account (vershwal) than the most recent previously approved version (gargol) on 2023-09-25. It has since remained available on npm for 1033 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account (gargol) than the most recent previously approved version (kevinansfield) on 2023-07-19, but gargol is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account (kevinansfield) than the most recent previously approved version (allouis) on 2023-07-05, but kevinansfield is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account (mike182uk) than the most recent previously approved version (allouis) on 2023-07-04, but mike182uk is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account (allouis) than the most recent previously approved version (daniellockyer) on 2023-06-12, but allouis is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account (sam-lord) than the most recent previously approved version (daniellockyer) on 2023-06-05, but sam-lord is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account (daniellockyer) than the most recent previously approved version (kevinansfield) on 2023-05-08, but daniellockyer is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account (gargol) than the most recent previously approved version (kevinansfield) on 2023-04-12, but gargol is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account (daniellockyer) than the most recent previously approved version (kevinansfield) on 2023-03-09, but daniellockyer is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account (kevinansfield) than the most recent previously approved version (simonbackx) on 2022-11-29, but kevinansfield is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account (kevinansfield) than the most recent previously approved version (simonbackx) on 2022-09-19, but kevinansfield is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account (simonbackx) than the most recent previously approved version (gargol) on 2022-09-06, but simonbackx is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account (rishabhgrg) than the most recent previously approved version (gargol) on 2022-08-05, but rishabhgrg is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account (gargol) than the most recent previously approved version (allouis) on 2022-06-01, but gargol is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account (erisds) than the most recent previously approved version (allouis) on 2022-05-27, but erisds is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account (allouis) than the most recent previously approved version (simonbackx) on 2022-05-16, but allouis is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account (gargol) than the most recent previously approved version (simonbackx) on 2022-05-16, but gargol is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account (simonbackx) than the most recent previously approved version (gargol) on 2022-05-09, but simonbackx is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account (erisds) than the most recent previously approved version (gargol) on 2022-05-05, but erisds is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account (gargol) than the most recent previously approved version (daniellockyer) on 2022-04-18, but gargol is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account (thibpat) than the most recent previously approved version (rishabhgrg) on 2022-04-11, but thibpat is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account (daniellockyer) than the most recent previously approved version (rishabhgrg) on 2022-03-24, but daniellockyer is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account (rishabhgrg) than the most recent previously approved version (gargol) on 2022-03-15, but rishabhgrg is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account (gargol) than the most recent previously approved version (allouis) on 2022-03-11, but gargol is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account (gargol) than the most recent previously approved version (allouis) on 2022-03-04, but gargol is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account (allouis) than the most recent previously approved version (kevinansfield) on 2022-01-20, but allouis is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account (rishabhgrg) than the most recent previously approved version (kevinansfield) on 2021-11-15, but rishabhgrg is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account (kevinansfield) than the most recent previously approved version (gargol) on 2021-11-08, but kevinansfield is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account (gargol) than the most recent previously approved version (rishabhgrg) on 2021-08-04, but gargol is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account (kevinansfield) than the most recent previously approved version (rishabhgrg) on 2021-07-29, but kevinansfield is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account (rishabhgrg) than the most recent previously approved version (allouis) on 2021-07-02, but rishabhgrg is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account (allouis) than the most recent previously approved version (kevinansfield) on 2021-06-24, but allouis is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account (erisds) than the most recent previously approved version (kevinansfield) on 2021-06-18, but erisds is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account (kevinansfield) than the most recent previously approved version (gargol) on 2021-06-09, but kevinansfield is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account (gargol) than the most recent previously approved version (kevinansfield) on 2021-05-13, but gargol is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account (kevinansfield) than the most recent previously approved version (allouis) on 2021-05-10, but kevinansfield is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account (daniellockyer) than the most recent previously approved version (allouis) on 2021-04-16, but daniellockyer is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account (allouis) than the most recent previously approved version (kevinansfield) on 2021-04-15, but allouis is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account (kevinansfield) than the most recent previously approved version (gargol) on 2021-03-31, but kevinansfield is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account (allouis) than the most recent previously approved version (gargol) on 2021-03-10, but allouis is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account (gargol) than the most recent previously approved version (daniellockyer) on 2021-03-03, but gargol is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account (gargol) than the most recent previously approved version (daniellockyer) on 2021-02-08, but gargol is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account (daniellockyer) than the most recent previously approved version (allouis) on 2021-01-12, but daniellockyer is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account (daniellockyer) than the most recent previously approved version (allouis) on 2021-01-07, but daniellockyer is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: kevinansfield.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account (allouis) than the most recent previously approved version (kevinansfield) on 2020-11-02, but allouis is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account (kevinansfield) than the most recent previously approved version (gargol) on 2020-10-16, but kevinansfield is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account (daniellockyer) than the most recent previously approved version (gargol) on 2020-08-13. It has since remained available on npm for 2171 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account (daniellockyer) than the most recent previously approved version (gargol) on 2020-08-11. It has since remained available on npm for 2173 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

URL pointing to known exfiltration/tunneling service (matched inside a comment — likely documentation, not executed code) Source: https://github.com/TryGhost/Ghost-SDK/tree/master/packages/helpers/blob/1e6e561fa3892c8e0804aae71c14f5bcbd526c67/es/helpers.js#L4195 4193 | // but for some reason `nativeSlice.call(result, 1, result.length)` (called in 4194 | // the slice polyfill when slicing native arrays) "doesn't work" in safari 9 and > 4195 | // causes a crash (https://pastebin.com/N21QzeQA) when trying to debug it. 4196 | for (var j = 1; j < result.length; j++) captures.push(maybeToString(result[j])); 4197 | var namedCaptures = result.groups;

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

URL pointing to known exfiltration/tunneling service (matched inside a comment — likely documentation, not executed code) Source: https://github.com/TryGhost/Ghost-SDK/tree/master/packages/helpers/blob/651a7230dc079ec86bd55671251258d3790befef/es/helpers.js#L4195 4193 | // but for some reason `nativeSlice.call(result, 1, result.length)` (called in 4194 | // the slice polyfill when slicing native arrays) "doesn't work" in safari 9 and > 4195 | // causes a crash (https://pastebin.com/N21QzeQA) when trying to debug it. 4196 | for (var j = 1; j < result.length; j++) captures.push(maybeToString(result[j])); 4197 | var namedCaptures = result.groups;

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account (erisds) than the most recent previously approved version (gargol) on 2020-04-13, but erisds is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

URL pointing to known exfiltration/tunneling service (matched inside a comment — likely documentation, not executed code) Source: https://github.com/TryGhost/Ghost-SDK/tree/master/packages/helpers/blob/cec7e0183304d3fc44c46f8a518cd20a17bb2de2/es/helpers.js#L4195 4193 | // but for some reason `nativeSlice.call(result, 1, result.length)` (called in 4194 | // the slice polyfill when slicing native arrays) "doesn't work" in safari 9 and > 4195 | // causes a crash (https://pastebin.com/N21QzeQA) when trying to debug it. 4196 | for (var j = 1; j < result.length; j++) captures.push(maybeToString(result[j])); 4197 | var namedCaptures = result.groups;

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account (erisds) than the most recent previously approved version (gargol) on 2020-04-10, but erisds is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

URL pointing to known exfiltration/tunneling service (matched inside a comment — likely documentation, not executed code) Source: https://github.com/TryGhost/Ghost-SDK/tree/master/packages/helpers/blob/3c5cef14bf54e60f5e9f7e6ad30b43ed283750e2/es/helpers.js#L4195 4193 | // but for some reason `nativeSlice.call(result, 1, result.length)` (called in 4194 | // the slice polyfill when slicing native arrays) "doesn't work" in safari 9 and > 4195 | // causes a crash (https://pastebin.com/N21QzeQA) when trying to debug it. 4196 | for (var j = 1; j < result.length; j++) captures.push(maybeToString(result[j])); 4197 | var namedCaptures = result.groups;

This version was published by a different npm account (daniellockyer) than the most recent previously approved version (gargol) on 2020-04-03. It has since remained available on npm for 2303 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

URL pointing to known exfiltration/tunneling service (matched inside a comment — likely documentation, not executed code) Source: https://github.com/TryGhost/Ghost-SDKs/tree/master/packages/helpers/blob/dd9183b679fb7ce1e6ea1467829f7c932e55e9b2/es/helpers.js#L4195 4193 | // but for some reason `nativeSlice.call(result, 1, result.length)` (called in 4194 | // the slice polyfill when slicing native arrays) "doesn't work" in safari 9 and > 4195 | // causes a crash (https://pastebin.com/N21QzeQA) when trying to debug it. 4196 | for (var j = 1; j < result.length; j++) captures.push(maybeToString(result[j])); 4197 | var namedCaptures = result.groups;

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account (erisds) than the most recent previously approved version (gargol) on 2020-03-26, but erisds is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

URL pointing to known exfiltration/tunneling service (matched inside a comment — likely documentation, not executed code) Source: https://github.com/TryGhost/Ghost-SDKs/tree/master/packages/helpers/blob/eeb763ba7ce4150198cfb5de797096961beae759/es/helpers.js#L4195 4193 | // but for some reason `nativeSlice.call(result, 1, result.length)` (called in 4194 | // the slice polyfill when slicing native arrays) "doesn't work" in safari 9 and > 4195 | // causes a crash (https://pastebin.com/N21QzeQA) when trying to debug it. 4196 | for (var j = 1; j < result.length; j++) captures.push(maybeToString(result[j])); 4197 | var namedCaptures = result.groups;

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account (kevinansfield) than the most recent previously approved version (gargol) on 2020-03-12, but kevinansfield is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

URL pointing to known exfiltration/tunneling service (matched inside a comment — likely documentation, not executed code) Source: https://github.com/TryGhost/Ghost-SDKs/tree/master/packages/helpers/blob/d6e5899d104bd8d1b6835a3effdb2596dc7a2694/es/helpers.js#L4195 4193 | // but for some reason `nativeSlice.call(result, 1, result.length)` (called in 4194 | // the slice polyfill when slicing native arrays) "doesn't work" in safari 9 and > 4195 | // causes a crash (https://pastebin.com/N21QzeQA) when trying to debug it. 4196 | for (var j = 1; j < result.length; j++) captures.push(maybeToString(result[j])); 4197 | var namedCaptures = result.groups;

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account (erisds) than the most recent previously approved version (gargol) on 2020-01-21, but erisds is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

URL pointing to known exfiltration/tunneling service (matched inside a comment — likely documentation, not executed code) Source: https://github.com/TryGhost/Ghost-SDKs/tree/master/packages/helpers/blob/9b9356fbb826cf087c3307291a74967bbe1774bf/es/helpers.js#L4195 4193 | // but for some reason `nativeSlice.call(result, 1, result.length)` (called in 4194 | // the slice polyfill when slicing native arrays) "doesn't work" in safari 9 and > 4195 | // causes a crash (https://pastebin.com/N21QzeQA) when trying to debug it. 4196 | for (var j = 1; j < result.length; j++) captures.push(maybeToString(result[j])); 4197 | var namedCaptures = result.groups;

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account (kevinansfield) than the most recent previously approved version (gargol) on 2020-01-15, but kevinansfield is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

URL pointing to known exfiltration/tunneling service (matched inside a comment — likely documentation, not executed code) Source: https://github.com/TryGhost/Ghost-SDKs/tree/master/packages/helpers/blob/6ab36a2887b325f857a528871d4eea670634aa46/es/helpers.js#L4195 4193 | // but for some reason `nativeSlice.call(result, 1, result.length)` (called in 4194 | // the slice polyfill when slicing native arrays) "doesn't work" in safari 9 and > 4195 | // causes a crash (https://pastebin.com/N21QzeQA) when trying to debug it. 4196 | for (var j = 1; j < result.length; j++) captures.push(maybeToString(result[j])); 4197 | var namedCaptures = result.groups;

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account (erisds) than the most recent previously approved version (gargol) on 2019-12-16, but erisds is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

URL pointing to known exfiltration/tunneling service (matched inside a comment — likely documentation, not executed code) Source: https://github.com/TryGhost/Ghost-SDKs/tree/master/packages/helpers/blob/282ac72b4f37bc2d3e4f13f5a173662c01146ffd/es/helpers.js#L4195 4193 | // but for some reason `nativeSlice.call(result, 1, result.length)` (called in 4194 | // the slice polyfill when slicing native arrays) "doesn't work" in safari 9 and > 4195 | // causes a crash (https://pastebin.com/N21QzeQA) when trying to debug it. 4196 | for (var j = 1; j < result.length; j++) captures.push(maybeToString(result[j])); 4197 | var namedCaptures = result.groups;

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account (erisds) than the most recent previously approved version (gargol) on 2019-11-12, but erisds is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

URL pointing to known exfiltration/tunneling service (matched inside a comment — likely documentation, not executed code) Source: https://github.com/TryGhost/Ghost-SDKs/tree/master/packages/helpers/blob/090c0f21206a402ea18287157535a037db65e4d3/es/helpers.js#L4195 4193 | // but for some reason `nativeSlice.call(result, 1, result.length)` (called in 4194 | // the slice polyfill when slicing native arrays) "doesn't work" in safari 9 and > 4195 | // causes a crash (https://pastebin.com/N21QzeQA) when trying to debug it. 4196 | for (var j = 1; j < result.length; j++) captures.push(maybeToString(result[j])); 4197 | var namedCaptures = result.groups;

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account (kevinansfield) than the most recent previously approved version (gargol) on 2019-10-30, but kevinansfield is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

URL pointing to known exfiltration/tunneling service (matched inside a comment — likely documentation, not executed code) Source: https://github.com/TryGhost/Ghost-SDKs/tree/master/packages/helpers/blob/029d695d6108710d5b798583cb06f9f35ebbda31/es/helpers.js#L4195 4193 | // but for some reason `nativeSlice.call(result, 1, result.length)` (called in 4194 | // the slice polyfill when slicing native arrays) "doesn't work" in safari 9 and > 4195 | // causes a crash (https://pastebin.com/N21QzeQA) when trying to debug it. 4196 | for (var j = 1; j < result.length; j++) captures.push(maybeToString(result[j])); 4197 | var namedCaptures = result.groups;

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

URL pointing to known exfiltration/tunneling service (matched inside a comment — likely documentation, not executed code) Source: https://github.com/TryGhost/Ghost-SDKs/tree/master/packages/helpers/blob/36d96ec8b67ce19296e077cadd0056cb3e36f565/es/helpers.js#L4195 4193 | // but for some reason `nativeSlice.call(result, 1, result.length)` (called in 4194 | // the slice polyfill when slicing native arrays) "doesn't work" in safari 9 and > 4195 | // causes a crash (https://pastebin.com/N21QzeQA) when trying to debug it. 4196 | for (var j = 1; j < result.length; j++) captures.push(maybeToString(result[j])); 4197 | var namedCaptures = result.groups;

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account (kevinansfield) than the most recent previously approved version (gargol) on 2019-10-14, but kevinansfield is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

URL pointing to known exfiltration/tunneling service (matched inside a comment — likely documentation, not executed code) Source: https://github.com/TryGhost/Ghost-SDKs/tree/master/packages/helpers/blob/e7ddda2c50607cb169486b464d3dceb908eef044/es/helpers.js#L4195 4193 | // but for some reason `nativeSlice.call(result, 1, result.length)` (called in 4194 | // the slice polyfill when slicing native arrays) "doesn't work" in safari 9 and > 4195 | // causes a crash (https://pastebin.com/N21QzeQA) when trying to debug it. 4196 | for (var j = 1; j < result.length; j++) captures.push(maybeToString(result[j])); 4197 | var namedCaptures = result.groups;

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

URL pointing to known exfiltration/tunneling service (matched inside a comment — likely documentation, not executed code) Source: https://github.com/TryGhost/Ghost-SDKs/tree/master/packages/helpers/blob/78d841f9abeae8631be093eab94dd5eb0a515125/es/helpers.js#L4195 4193 | // but for some reason `nativeSlice.call(result, 1, result.length)` (called in 4194 | // the slice polyfill when slicing native arrays) "doesn't work" in safari 9 and > 4195 | // causes a crash (https://pastebin.com/N21QzeQA) when trying to debug it. 4196 | for (var j = 1; j < result.length; j++) captures.push(maybeToString(result[j])); 4197 | var namedCaptures = result.groups;

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

URL pointing to known exfiltration/tunneling service (matched inside a comment — likely documentation, not executed code) Source: https://github.com/TryGhost/Ghost-SDKs/tree/master/packages/helpers/blob/3c167e5917e7a49a0a5fa213a2edd86e084a81a3/es/helpers.js#L4195 4193 | // but for some reason `nativeSlice.call(result, 1, result.length)` (called in 4194 | // the slice polyfill when slicing native arrays) "doesn't work" in safari 9 and > 4195 | // causes a crash (https://pastebin.com/N21QzeQA) when trying to debug it. 4196 | for (var j = 1; j < result.length; j++) captures.push(maybeToString(result[j])); 4197 | var namedCaptures = result.groups;

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account (kevinansfield) than the most recent previously approved version (gargol) on 2019-10-07, but kevinansfield is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

URL pointing to known exfiltration/tunneling service (matched inside a comment — likely documentation, not executed code) Source: https://github.com/TryGhost/Ghost-SDKs/tree/master/packages/helpers/blob/6efaff343b2059daa2c287f2db9c456c7f1a63d6/es/helpers.js#L4195 4193 | // but for some reason `nativeSlice.call(result, 1, result.length)` (called in 4194 | // the slice polyfill when slicing native arrays) "doesn't work" in safari 9 and > 4195 | // causes a crash (https://pastebin.com/N21QzeQA) when trying to debug it. 4196 | for (var j = 1; j < result.length; j++) captures.push(maybeToString(result[j])); 4197 | var namedCaptures = result.groups;

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account (kevinansfield) than the most recent previously approved version (gargol) on 2019-10-02, but kevinansfield is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

URL pointing to known exfiltration/tunneling service (matched inside a comment — likely documentation, not executed code) Source: https://github.com/TryGhost/Ghost-SDKs/tree/master/packages/helpers/blob/8ec705561ebcc7c2fe0e98460b7641985df54586/es/helpers.js#L4194 4192 | // but for some reason `nativeSlice.call(result, 1, result.length)` (called in 4193 | // the slice polyfill when slicing native arrays) "doesn't work" in safari 9 and > 4194 | // causes a crash (https://pastebin.com/N21QzeQA) when trying to debug it. 4195 | for (var j = 1; j < result.length; j++) captures.push(maybeToString(result[j])); 4196 | var namedCaptures = result.groups;

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account (kevinansfield) than the most recent previously approved version (gargol) on 2019-09-25, but kevinansfield is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

URL pointing to known exfiltration/tunneling service (matched inside a comment — likely documentation, not executed code) Source: https://github.com/TryGhost/Ghost-SDKs/tree/master/packages/helpers/blob/1c44501e8d63bc195c39c5b02132832fa8fdbe90/es/helpers.js#L4194 4192 | // but for some reason `nativeSlice.call(result, 1, result.length)` (called in 4193 | // the slice polyfill when slicing native arrays) "doesn't work" in safari 9 and > 4194 | // causes a crash (https://pastebin.com/N21QzeQA) when trying to debug it. 4195 | for (var j = 1; j < result.length; j++) captures.push(maybeToString(result[j])); 4196 | var namedCaptures = result.groups;

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account (aileencgn) than the most recent previously approved version (gargol) on 2019-09-18, but aileencgn is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

URL pointing to known exfiltration/tunneling service (matched inside a comment — likely documentation, not executed code) Source: https://github.com/TryGhost/Ghost-SDKs/tree/master/packages/helpers/blob/c9cca1a51eb2a80c72942bf8f1b90812dea95bbc/es/helpers.js#L4194 4192 | // but for some reason `nativeSlice.call(result, 1, result.length)` (called in 4193 | // the slice polyfill when slicing native arrays) "doesn't work" in safari 9 and > 4194 | // causes a crash (https://pastebin.com/N21QzeQA) when trying to debug it. 4195 | for (var j = 1; j < result.length; j++) captures.push(maybeToString(result[j])); 4196 | var namedCaptures = result.groups;

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account (kevinansfield) than the most recent previously approved version (gargol) on 2019-09-05, but kevinansfield is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

URL pointing to known exfiltration/tunneling service (matched inside a comment — likely documentation, not executed code) Source: https://github.com/TryGhost/Ghost-SDKs/tree/master/packages/helpers/blob/2dcdda385297c5ffd81483271b283164ffa979d0/es/helpers.js#L4194 4192 | // but for some reason `nativeSlice.call(result, 1, result.length)` (called in 4193 | // the slice polyfill when slicing native arrays) "doesn't work" in safari 9 and > 4194 | // causes a crash (https://pastebin.com/N21QzeQA) when trying to debug it. 4195 | for (var j = 1; j < result.length; j++) captures.push(maybeToString(result[j])); 4196 | var namedCaptures = result.groups;

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account (kevinansfield) than the most recent previously approved version (gargol) on 2019-08-12, but kevinansfield is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

URL pointing to known exfiltration/tunneling service (matched inside a comment — likely documentation, not executed code) Source: https://github.com/TryGhost/Ghost-SDKs/tree/master/packages/helpers/blob/096adf0f7adde4a9c1f6da9ecd1b650571174fff/es/helpers.js#L4194 4192 | // but for some reason `nativeSlice.call(result, 1, result.length)` (called in 4193 | // the slice polyfill when slicing native arrays) "doesn't work" in safari 9 and > 4194 | // causes a crash (https://pastebin.com/N21QzeQA) when trying to debug it. 4195 | for (var j = 1; j < result.length; j++) captures.push(maybeToString(result[j])); 4196 | var namedCaptures = result.groups;

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account (kevinansfield) than the most recent previously approved version (gargol) on 2019-07-25, but kevinansfield is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

URL pointing to known exfiltration/tunneling service (matched inside a comment — likely documentation, not executed code) Source: https://github.com/TryGhost/Ghost-SDKs/tree/master/packages/helpers/blob/00bce21c1ac2d45c722b941e6cc88640a5651503/es/helpers.js#L4194 4192 | // but for some reason `nativeSlice.call(result, 1, result.length)` (called in 4193 | // the slice polyfill when slicing native arrays) "doesn't work" in safari 9 and > 4194 | // causes a crash (https://pastebin.com/N21QzeQA) when trying to debug it. 4195 | for (var j = 1; j < result.length; j++) captures.push(maybeToString(result[j])); 4196 | var namedCaptures = result.groups;

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.