@twemoji/api

Supply chain provenance

Status for the latest visible version.

Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.

Maintainers

Keywords

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
publish-pattern	new-deps-added	AI (publish-pattern): @twemoji/parser is the same-org scoped replacement for twemoji-parser; expected migration, not a supply-chain injection.	ai	2026/05/27
phantom-deps	phantom-dep:twemoji-parser	AI (phantom-deps): Peer/runtime dep used in build pipeline; stable false positive for this package.	ai	2026/05/26
typosquat	typosquat.levenshtein:pg	AI (typosquat): No plausible squatting of 'pg' by a scoped emoji package.	ai	2026/05/26
typosquat	typosquat.levenshtein:joi	AI (typosquat): No plausible squatting of 'joi' by a scoped emoji package.	ai	2026/05/26
typosquat	typosquat.levenshtein:ajv	AI (typosquat): No plausible squatting of 'ajv' by a scoped emoji package.	ai	2026/05/26
phantom-deps	phantom-dep:jsonfile	AI (phantom-deps): Build-time dependency; stable false positive for this package.	ai	2026/05/26
phantom-deps	phantom-dep:universalify	AI (phantom-deps): Build-time dependency; stable false positive for this package.	ai	2026/05/26
phantom-deps	phantom-dep:@twemoji/parser	AI (phantom-deps): Same-org scoped dependency; phantom-dep heuristic is a false positive here.	ai	2026/05/26
phantom-deps	phantom-dep:fs-extra	AI (phantom-deps): Build-time dependency used in build scripts, not imported in dist; stable false positive for this package.	ai	2026/05/26
typosquat	typosquat.levenshtein:hapi	AI (typosquat): @twemoji/api is a scoped emoji package; Levenshtein match to 'hapi' is a false positive.	ai	2026/05/26

Version	Deps	Published
17.0.3	4 / 3	2026-06-01
17.0.2	4 / 3	2025-11-04
17.0.1	4 / 3	2025-11-03
17.0.0	4 / 3	2025-11-03
14.1.0	4 / 3	2023-01-12