← Home

@utoo/pack-darwin-arm64

npm Repository Homepage

This is the **aarch64-apple-darwin** binary for `@utoo/pack`

8
Versions
MIT
License
No
Install Scripts
Verified
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures gitHead linked

Maintainers

afc163elrrrrrrrxusd320zoomdong07

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
publish-pattern rapid-publish AI (publish-pattern): Rapid publish reflects monorepo multi-arch release pattern, not malicious automation. ai
bogus-package bogus-package AI (bogus-package): Platform-binary sub-package legitimately has no code/deps/readme content. ai

Versions (showing 8 of 8)

Version Deps Published
1.4.27 0 / 0
1.4.26 0 / 0
1.4.25 0 / 0
1.4.24 0 / 0
1.4.21 0 / 0
1.4.19 0 / 0
1.4.18 0 / 0
1.4.1 0 / 0

v1.4.27

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.4.26

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.4.25

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.4.24

3 findings
HIGH Low-value / spam package indicators (5 signals, score 8) bogus-package

[Reject — re-review on republish] (prior reject: AI (bogus-package): SPAM-FLAGGED publisher with 401 rejections; package has no repo, no deps, no meaningful content — generalizes to all versions.) Matched 5 signal(s), weighted score 8: • [S_KNOWN_SPAM_PUBLISHER] Maintainer(s) previously flagged as spam: elrrrrrrr. • [S_README_NO_CODE] Short README with no code block, no install instructions, and no usage/API section. • [S_NO_KEYWORDS] No keywords declared. • [S_NO_DEPS] No runtime, dev, peer, or optional dependencies declared. • [S_TINY_PAYLOAD] Tiny payload: 0 code file(s), 473 bytes total.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

INFO Publisher changed: elrrrrrrr → GitHub Actions (on 2026-07-13, now via trusted publisher with provenance) provenance

This version was published by a different npm account (GitHub Actions) than the most recent previously approved version (elrrrrrrr) on 2026-07-13, but it carries Sigstore provenance attestation. This means the package moved to a trusted publisher (CI/CD with OIDC, e.g. GitHub Actions) — a supply-chain integrity improvement, not a compromise, since a stolen npm token cannot forge provenance bound to the source repository. Recorded as INFO for audit trail.

v1.4.21

3 findings
HIGH Publisher changed: elrrrrrrr → GitHub Actions (on 2026-07-08) provenance

This version was published by a different npm account than previous versions on 2026-07-08. This could indicate a legitimate maintainer transition or an account compromise.

HIGH Low-value / spam package indicators (5 signals, score 8) bogus-package

[Reject — re-review on republish] (prior reject: AI (bogus-package): SPAM-FLAGGED publisher with 401 rejections; package has no repo, no deps, no meaningful content — generalizes to all versions.) Matched 5 signal(s), weighted score 8: • [S_KNOWN_SPAM_PUBLISHER] Maintainer(s) previously flagged as spam: elrrrrrrr. • [S_README_NO_CODE] Short README with no code block, no install instructions, and no usage/API section. • [S_NO_KEYWORDS] No keywords declared. • [S_NO_DEPS] No runtime, dev, peer, or optional dependencies declared. • [S_TINY_PAYLOAD] Tiny payload: 0 code file(s), 473 bytes total.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.4.19

2 findings
HIGH Low-value / spam package indicators (5 signals, score 8) bogus-package

[Reject — re-review on republish] (prior reject: AI (bogus-package): SPAM-FLAGGED publisher with 401 rejections; package has no repo, no deps, no meaningful content — generalizes to all versions.) Matched 5 signal(s), weighted score 8: • [S_KNOWN_SPAM_PUBLISHER] Maintainer(s) previously flagged as spam: elrrrrrrr. • [S_README_NO_CODE] Short README with no code block, no install instructions, and no usage/API section. • [S_NO_KEYWORDS] No keywords declared. • [S_NO_DEPS] No runtime, dev, peer, or optional dependencies declared. • [S_TINY_PAYLOAD] Tiny payload: 0 code file(s), 473 bytes total.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.4.18

2 findings
HIGH Low-value / spam package indicators (5 signals, score 8) bogus-package

[Reject — re-review on republish] (prior reject: AI (bogus-package): SPAM-FLAGGED publisher with 401 rejections; package has no repo, no deps, no meaningful content — generalizes to all versions.) Matched 5 signal(s), weighted score 8: • [S_KNOWN_SPAM_PUBLISHER] Maintainer(s) previously flagged as spam: elrrrrrrr. • [S_README_NO_CODE] Short README with no code block, no install instructions, and no usage/API section. • [S_NO_KEYWORDS] No keywords declared. • [S_NO_DEPS] No runtime, dev, peer, or optional dependencies declared. • [S_TINY_PAYLOAD] Tiny payload: 0 code file(s), 473 bytes total.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.