← Home

@utoo/pack-darwin-x64

npm Repository Homepage

This is the **x86_64-apple-darwin** binary for `@utoo/pack`

4
Versions
MIT
License
No
Install Scripts
Verified
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures gitHead linked

Maintainers

afc163elrrrrrrrxusd320zoomdong07

Versions (showing 4 of 4)

Version Deps Published
1.4.24 0 / 0
1.4.20 0 / 0
1.4.19 0 / 0
1.4.1 0 / 0

v1.4.24

3 findings
HIGH Low-value / spam package indicators (5 signals, score 8) bogus-package

[Reject — re-review on republish] (prior reject: AI (bogus-package): SPAM-FLAGGED publisher with 462 rejected packages; all packages from this publisher are tainted.) Matched 5 signal(s), weighted score 8: • [S_KNOWN_SPAM_PUBLISHER] Maintainer(s) previously flagged as spam: elrrrrrrr. • [S_README_NO_CODE] Short README with no code block, no install instructions, and no usage/API section. • [S_NO_KEYWORDS] No keywords declared. • [S_NO_DEPS] No runtime, dev, peer, or optional dependencies declared. • [S_TINY_PAYLOAD] Tiny payload: 0 code file(s), 462 bytes total.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

INFO Publisher changed: elrrrrrrr → GitHub Actions (on 2026-07-13, now via trusted publisher with provenance) provenance

This version was published by a different npm account (GitHub Actions) than the most recent previously approved version (elrrrrrrr) on 2026-07-13, but it carries Sigstore provenance attestation. This means the package moved to a trusted publisher (CI/CD with OIDC, e.g. GitHub Actions) — a supply-chain integrity improvement, not a compromise, since a stolen npm token cannot forge provenance bound to the source repository. Recorded as INFO for audit trail.

v1.4.20

2 findings
HIGH Low-value / spam package indicators (5 signals, score 8) bogus-package

[Reject — re-review on republish] (prior reject: AI (bogus-package): SPAM-FLAGGED publisher with 462 rejected packages; all packages from this publisher are tainted.) Matched 5 signal(s), weighted score 8: • [S_KNOWN_SPAM_PUBLISHER] Maintainer(s) previously flagged as spam: elrrrrrrr. • [S_README_NO_CODE] Short README with no code block, no install instructions, and no usage/API section. • [S_NO_KEYWORDS] No keywords declared. • [S_NO_DEPS] No runtime, dev, peer, or optional dependencies declared. • [S_TINY_PAYLOAD] Tiny payload: 0 code file(s), 462 bytes total.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.4.19

2 findings
HIGH Low-value / spam package indicators (5 signals, score 8) bogus-package

[Reject — re-review on republish] (prior reject: AI (bogus-package): SPAM-FLAGGED publisher with 462 rejected packages; all packages from this publisher are tainted.) Matched 5 signal(s), weighted score 8: • [S_KNOWN_SPAM_PUBLISHER] Maintainer(s) previously flagged as spam: elrrrrrrr. • [S_README_NO_CODE] Short README with no code block, no install instructions, and no usage/API section. • [S_NO_KEYWORDS] No keywords declared. • [S_NO_DEPS] No runtime, dev, peer, or optional dependencies declared. • [S_TINY_PAYLOAD] Tiny payload: 0 code file(s), 462 bytes total.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.