← Home

@ttoss/read-config-file

npm Repository
29
Versions
—
License
No
Install Scripts
Attested
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation (unverified) npm registry signatures No source commit

Maintainers

techtriangulostecnologiapedroarantes

Keywords

configconfig-loaderconfigurationesbuildjsonnodejsread-config-filetypescript-configyaml

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
provenance publisher-changed AI (provenance): pedro-arantes and pedroarantes are the same person; username rename confirmed by consistent author metadata and SLSA provenance. ai
maintainer-change maintainer-added AI (maintainer-change): New maintainer is the same individual under a renamed npm account; not a third-party takeover. ai
maintainer-change maintainer-removed AI (maintainer-change): Removal of pedro-arantes is the other side of the same account rename; not a hostile removal. ai
dependencies unvetted-dep:import-sync AI (dependencies): import-sync is a legitimate utility for sync ES module loading; consistent with this config-file-reading package's use case. ai

Versions (showing 29 of 29)

Version Deps Published
2.2.20 2 / 7
2.2.14 2 / 7
2.2.13 2 / 7
2.2.12 2 / 7
2.2.11 3 / 7
2.2.10 3 / 7
2.2.9 3 / 7
2.2.8 3 / 7
2.2.7 3 / 7
2.2.6 3 / 7
2.2.5 3 / 7
2.1.0 3 / 7
2.0.20 3 / 7
2.0.19 3 / 7
2.0.18 3 / 7
2.0.17 3 / 7
2.0.16 3 / 7
2.0.15 3 / 7
2.0.14 3 / 7
2.0.13 3 / 7
2.0.12 3 / 7
2.0.11 3 / 7
2.0.10 3 / 7
2.0.9 3 / 7
2.0.8 3 / 7
2.0.7 3 / 7
2.0.6 3 / 7
2.0.5 3 / 7
2.0.4 3 / 7

v2.0.9

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v2.0.8

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v2.0.7

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v2.0.6

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v2.0.5

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v2.0.4

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.