@vimeo/player — Greenflagged

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.

Maintainers

rowankrishnanvimeo-npmbotcxiang

Keywords

vimeoplayerapiiframeembedvideojavascriptpostMessage

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
source-diff	net-exec-file-transition:dist/player.es.js	AI (source-diff): Bundled player SDK; XHR + babel-runtime regenerator, no hostile destination.	ai	2026/07/20
source-diff	net-exec-file-transition:dist/player.min.js	AI (source-diff): Minified build of same player code, benign.	ai	2026/07/20
source-diff	net-exec-file-transition:dist/player.js	AI (source-diff): Same bundled build output, benign player code.	ai	2026/07/20
provenance	publisher-changed-stale	AI (provenance): Publisher change is a stable Vimeo team transition.	ai	2026/07/20
maintainer-change	maintainer-takeover	AI (maintainer-change): Legitimate Vimeo org handoff, live 1602d without unpublish; not a hijack.	ai	2026/07/20
provenance	missing-githead	AI (provenance): Publish-env change on trusted first-party package; no behavioral risk.	ai	2026/07/20
dependencies	unvetted-dep:es6-collections	AI (dependencies): Legacy polyfill dep, stable and benign for this old official package.	ai	2026/07/20
email-domain	unclaimed-email:https://vimeo.com	AI (email-domain): The author field contains a URL (https://vimeo.com), not an email address. The analyzer is misinterpreting the URL as an email domain. vimeo.com is a live, well-known domain — stable false positive for this package.	ai	2026/04/25
dependencies	unvetted-dep:weakmap-polyfill	AI (dependencies): weakmap-polyfill is a small, well-known polyfill that has been a stable dependency of this package across many versions. No security concerns.	ai	2026/04/25

Versions (showing 69 of 69)

Version	Deps	Published
2.30.4	2 / 32	2026-04-29
2.30.3	2 / 32	2026-03-04
2.30.2	2 / 32	2026-01-30
2.30.1	2 / 32	2025-10-29
2.30.0	2 / 32	2025-10-20
2.29.7	2 / 32	2025-09-16
2.29.6	2 / 31	2025-09-11
2.29.5	2 / 31	2025-09-08
2.29.4	2 / 31	2025-09-05
2.29.3	2 / 31	2025-08-06
2.29.2	2 / 31	2025-07-28
2.29.1	2 / 31	2025-07-14
2.29.0	2 / 32	2025-06-05
2.28.0	2 / 32	2025-06-05
2.27.1	2 / 32	2025-05-07
2.27.0	2 / 32	2025-05-06
2.26.0	2 / 32	2025-03-07
2.25.1	2 / 32	2025-01-23
2.25.0	2 / 32	2024-11-14
2.24.0	2 / 32	2024-08-20
2.23.1	2 / 32	2024-08-12
2.23.0	2 / 32	2024-04-24
2.22.0	2 / 32	2024-03-06
2.21.0	2 / 32	2024-01-02
2.20.1	2 / 33	2023-05-25
2.20.0	2 / 33	2023-05-25
2.19.0	2 / 32	2023-04-21
2.18.0	2 / 32	2022-10-04
2.17.1	2 / 32	2022-06-27
2.17.0	2 / 32	2022-06-09
2.16.4	2 / 32	2022-02-28
2.16.3	2 / 32	2022-02-01
2.16.2	2 / 32	2021-11-09
2.16.1	2 / 32	2021-09-08
2.16.0	2 / 32	2021-07-29
2.15.3	2 / 32	2021-06-07
2.15.0	2 / 32	2021-01-13
2.14.1	2 / 32	2020-10-13
2.14.0	2 / 32	2020-10-02
2.13.0	2 / 32	2020-09-02
2.12.2	2 / 32	2020-07-10
2.12.1	2 / 32	2020-07-08
2.12.0	2 / 33	2020-06-02
2.11.0	2 / 33	2020-04-14
2.10.0	2 / 33	2019-07-11
2.9.1	2 / 33	2019-05-03
2.9.0	2 / 33	2019-05-02
2.8.2	2 / 33	2019-03-13
2.8.1	2 / 33	2019-03-07
2.8.0	2 / 33	2019-02-27
2.7.0	2 / 34	2019-01-30
2.6.7	2 / 33	2019-01-09
2.6.6	2 / 33	2019-01-09
2.6.5	2 / 33	2018-11-06
2.6.4	2 / 33	2018-10-16
2.6.3	2 / 33	2018-06-26
2.6.1	2 / 26	2018-04-24
2.6.0	2 / 26	2018-04-24
2.5.0	2 / 26	2018-03-27
2.4.0	2 / 26	2018-03-23
2.3.1	2 / 26	2018-03-14
2.3.0	2 / 26	2018-03-01
2.2.1	2 / 26	2017-11-29
2.2.0	2 / 26	2017-09-07
2.1.1	2 / 26	2017-08-31
2.1.0	2 / 26	2017-05-19
2.0.2	2 / 26	2017-05-12
2.0.1	2 / 25	2016-12-06
2.0.0	2 / 25	2016-12-06

v2.26.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.25.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.25.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.24.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.23.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.23.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.21.0

2 findings

MEDIUM Publisher changed: luwes → vimeo-npmbot (on 2024-01-02, unremoved on npm for 929d) provenance

This version was published by a different npm account (vimeo-npmbot) than the most recent previously approved version (luwes) on 2024-01-02. It has since remained available on npm for 929 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.20.1

3 findings

HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: rowankrishnan.

MEDIUM Publisher changed: luwes → rowankrishnan (on 2023-05-25, unremoved on npm for 1151d) provenance

This version was published by a different npm account (rowankrishnan) than the most recent previously approved version (luwes) on 2023-05-25. It has since remained available on npm for 1151 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.20.0

6 findings

HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: rowankrishnan.

HIGH Modified file gained network + code execution: dist/player.es.js source-diff

This file did not combine network calls with dynamic code execution in the previously greenflagged version, and now does. Gaining both halves in an existing file is a hallmark of a dropper/loader introduced by an update.

HIGH Modified file gained network + code execution: dist/player.js source-diff

This file did not combine network calls with dynamic code execution in the previously greenflagged version, and now does. Gaining both halves in an existing file is a hallmark of a dropper/loader introduced by an update.

HIGH Modified file gained network + code execution: dist/player.min.js source-diff

This file did not combine network calls with dynamic code execution in the previously greenflagged version, and now does. Gaining both halves in an existing file is a hallmark of a dropper/loader introduced by an update.

MEDIUM Publisher changed: luwes → rowankrishnan (on 2023-05-25, unremoved on npm for 1151d) provenance

This version was published by a different npm account (rowankrishnan) than the most recent previously approved version (luwes) on 2023-05-25. It has since remained available on npm for 1151 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.19.0

3 findings

HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: rowankrishnan.

MEDIUM Publisher changed: luwes → rowankrishnan (on 2023-04-21, unremoved on npm for 1185d) provenance

This version was published by a different npm account (rowankrishnan) than the most recent previously approved version (luwes) on 2023-04-21. It has since remained available on npm for 1185 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.18.0

3 findings

HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: rowankrishnan.

MEDIUM Publisher changed: luwes → rowankrishnan (on 2022-10-04, unremoved on npm for 1384d) provenance

This version was published by a different npm account (rowankrishnan) than the most recent previously approved version (luwes) on 2022-10-04. It has since remained available on npm for 1384 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.17.1

3 findings

HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: rowankrishnan.

MEDIUM Publisher changed: luwes → rowankrishnan (on 2022-06-27, unremoved on npm for 1483d) provenance

This version was published by a different npm account (rowankrishnan) than the most recent previously approved version (luwes) on 2022-06-27. It has since remained available on npm for 1483 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.17.0

3 findings

HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: rowankrishnan.

MEDIUM Publisher changed: luwes → rowankrishnan (on 2022-06-09, unremoved on npm for 1501d) provenance

This version was published by a different npm account (rowankrishnan) than the most recent previously approved version (luwes) on 2022-06-09. It has since remained available on npm for 1501 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.16.4

3 findings

HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: brandonhrowe.

MEDIUM Publisher changed: luwes → brandonhrowe (on 2022-02-28, unremoved on npm for 1602d) provenance

This version was published by a different npm account (brandonhrowe) than the most recent previously approved version (luwes) on 2022-02-28. It has since remained available on npm for 1602 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.16.3

3 findings

HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: brandonhrowe.

MEDIUM Publisher changed: luwes → brandonhrowe (on 2022-02-01, unremoved on npm for 1629d) provenance

This version was published by a different npm account (brandonhrowe) than the most recent previously approved version (luwes) on 2022-02-01. It has since remained available on npm for 1629 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.16.2

3 findings

HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: rowankrishnan.

MEDIUM Publisher changed: luwes → rowankrishnan (on 2021-11-09, unremoved on npm for 1713d) provenance

This version was published by a different npm account (rowankrishnan) than the most recent previously approved version (luwes) on 2021-11-09. It has since remained available on npm for 1713 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.16.1

3 findings

HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: rowankrishnan.

MEDIUM Publisher changed: luwes → rowankrishnan (on 2021-09-08, unremoved on npm for 1775d) provenance

This version was published by a different npm account (rowankrishnan) than the most recent previously approved version (luwes) on 2021-09-08. It has since remained available on npm for 1775 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.16.0

3 findings

HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: rowankrishnan.

MEDIUM Publisher changed: luwes → rowankrishnan (on 2021-07-29, unremoved on npm for 1816d) provenance

This version was published by a different npm account (rowankrishnan) than the most recent previously approved version (luwes) on 2021-07-29. It has since remained available on npm for 1816 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.15.3

2 findings

HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: luwes.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.15.0

2 findings

HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: luwes.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.14.1

2 findings

HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: luwes.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.14.0

2 findings

HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: luwes.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.13.0

2 findings

HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: luwes.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.12.2

2 findings

HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: luwes.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.12.1

2 findings

HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: luwes.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.12.0

2 findings

HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: luwes.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.11.0

2 findings

HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: luwes.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.10.0

2 findings

HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: luwes.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.9.1

2 findings

HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: luwes.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.9.0

2 findings

HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: luwes.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.8.2

2 findings

HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: luwes.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.8.1

2 findings

HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: luwes.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.8.0

2 findings

HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: luwes.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.7.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.6.7

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.6.6

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.6.5

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.6.4

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.6.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.6.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.6.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.5.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.4.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.3.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.3.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.2.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.2.0

2 findings

MEDIUM Publisher changed: bdougherty → luwes (on 2017-09-07, unremoved on npm for 3237d) provenance

This version was published by a different npm account (luwes) than the most recent previously approved version (bdougherty) on 2017-09-07. It has since remained available on npm for 3237 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.1.1

2 findings

MEDIUM Publisher changed: bdougherty → luwes (on 2017-08-31, unremoved on npm for 3244d) provenance

This version was published by a different npm account (luwes) than the most recent previously approved version (bdougherty) on 2017-08-31. It has since remained available on npm for 3244 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.1.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.0.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.0.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.0.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.