@twilio/notifications
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| semgrep | semgrep:shady-links-exfil-services | AI (semgrep): Match is a pastebin URL in a code comment, not executed; stable FP for this build bundle. | ai | |
| dependencies | unvetted-dep:twilsock | AI (dependencies): twilsock is a first-party Twilio dependency. | ai |
v2.0.10
2 findingsURL pointing to known exfiltration/tunneling service (matched inside a comment — likely documentation, not executed code) Source: https://github.com/twilio/twilio-notifications.js/blob/dd665019470eb1d92b4d89e4ff2caccb5f59ec93/builds/twilio-notifications.js#L8005 8003 | // but for some reason `nativeSlice.call(result, 1, result.length)` (called in 8004 | // the slice polyfill when slicing native arrays) "doesn't work" in safari 9 and > 8005 | // causes a crash (https://pastebin.com/N21QzeQA) when trying to debug it. 8006 | for (var j = 1; j < result.length; j++) captures.push(maybeToString(result[j])); 8007 | var namedCaptures = result.groups;
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v2.0.9
2 findingsURL pointing to known exfiltration/tunneling service (matched inside a comment — likely documentation, not executed code) Source: https://github.com/twilio/twilio-notifications.js/blob/d1ce6f9b390ffb64a24814248c09bd810e871e85/builds/twilio-notifications.js#L7970 7968 | // but for some reason `nativeSlice.call(result, 1, result.length)` (called in 7969 | // the slice polyfill when slicing native arrays) "doesn't work" in safari 9 and > 7970 | // causes a crash (https://pastebin.com/N21QzeQA) when trying to debug it. 7971 | for (var j = 1; j < result.length; j++) captures.push(maybeToString(result[j])); 7972 | var namedCaptures = result.groups;
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.