← Home

@turnkey/sdk-browser

npm Repository Homepage
48
Versions
—
License
No
Install Scripts
Verified
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures No source commit

Maintainers

andrewtkr-n-ojack-kearney-tkhq

Keywords

Turnkey

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
provenance publisher-changed AI (provenance): Transition from individual publisher to GitHub Actions CI/CD with SLSA attestation from official tkhq/sdk repo is a legitimate and expected migration. ai
maintainer-change maintainer-removed AI (maintainer-change): Maintainer consolidation consistent with org-level CI/CD publishing; SLSA provenance confirms official repo origin. ai
phantom-deps phantom-dep:cross-fetch AI (phantom-deps): cross-fetch is a declared runtime dep; phantom-dep heuristic fires incorrectly for this package. ai

Versions (showing 48 of 48)

Version Deps Published
7.0.0 12 / 2
6.1.1 12 / 2
6.1.0 12 / 2
6.0.0 12 / 2
5.16.1 12 / 2
5.16.0 12 / 2
5.15.2 12 / 2
5.15.1 12 / 2
5.15.0 12 / 2
5.14.3 12 / 2
5.14.2 12 / 2
5.14.1 12 / 2
5.14.0 12 / 2
5.13.6 12 / 2
5.13.5 12 / 2
5.13.4 12 / 2
5.13.3 12 / 2
5.13.2 12 / 2
5.13.1 12 / 2
5.13.0 12 / 2
5.12.0 12 / 2
5.11.6 12 / 2
5.11.5 12 / 2
5.11.4 12 / 2
5.11.3 12 / 2
5.11.2 12 / 2
5.11.1 12 / 2
5.11.0 12 / 2
5.10.1 12 / 2
5.10.0 12 / 2
5.9.0 13 / 2
5.8.0 13 / 2
5.7.0 13 / 2
5.6.0 13 / 2
5.5.0 13 / 2
5.4.1 13 / 2
5.4.0 13 / 2
5.3.4 13 / 2
5.3.3 13 / 2
5.3.2 13 / 2
5.3.1 13 / 2
5.3.0 13 / 2
5.2.3 13 / 2
5.2.2 13 / 2
5.2.1 13 / 2
5.2.0 13 / 2
5.1.0 13 / 2
5.0.0 12 / 2

v7.0.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.