← Home

@uniswap/ai-toolkit-notion-publisher

npm Repository Homepage

CLI tool to publish release notes to Notion databases with markdown support

7
Versions
—
License
No
Install Scripts
Verified
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures gitHead linked

Maintainers

uniswap-labs-service-accountuniswap-labs-owner-account

Keywords

notionrelease-notescliuniswapai-toolkit

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
provenance publisher-changed AI (provenance): Transition to GitHub Actions CI publishing with SLSA provenance; consistent with Uniswap org's CI/CD practices. ai
dependencies unvetted-dep:@tryfabric/martian AI (dependencies): @tryfabric/martian is the canonical markdown-to-Notion library; its use is expected for a Notion publisher tool. ai
phantom-deps phantom-dep:tslib AI (phantom-deps): tslib is a known implicit TypeScript runtime dep; stable false positive for this package. ai

Versions (showing 7 of 7)

Version Deps Published
0.0.18 4 / 1
0.0.17 4 / 1
0.0.16 4 / 1
0.0.12 4 / 1
0.0.3 4 / 1
0.0.2 4 / 1
0.0.1 0 / 0

v0.0.18

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.0.12

2 findings
HIGH Publisher changed: uniswap-labs-owner-account → GitHub Actions (on 2026-01-15) provenance

This version was published by a different npm account than previous versions on 2026-01-15. This could indicate a legitimate maintainer transition or an account compromise.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.0.3

2 findings
HIGH Publisher changed: uniswap-labs-owner-account → GitHub Actions (on 2025-12-06) provenance

This version was published by a different npm account than previous versions on 2025-12-06. This could indicate a legitimate maintainer transition or an account compromise.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.2

2 findings
HIGH Publisher changed: uniswap-labs-owner-account → GitHub Actions (on 2025-12-03) provenance

This version was published by a different npm account than previous versions on 2025-12-03. This could indicate a legitimate maintainer transition or an account compromise.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.