@vitessce/image-utils
Supply chain provenance
Status for the latest visible version.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| npm-metadata | no-description | AI (npm-metadata): Scoped package in established ecosystem; missing description is metadata-only, not a malware indicator. | ai | |
| dependencies | unvetted-dep:@hms-dbmi/viv | AI (dependencies): Known imaging library from the same HMS lab that maintains vitessce; stable dependency across versions. | ai | |
| dependencies | unvetted-dep:@vitessce/utils | AI (dependencies): First-party vitessce monorepo package; stable sibling dependency. | ai | |
| dependencies | unvetted-dep:@vitessce/spatial-utils | AI (dependencies): First-party vitessce monorepo package; stable sibling dependency. | ai |
Versions (showing 5 of 5)
| Version | Deps | Published |
|---|---|---|
| 3.9.11 | 5 / 2 | |
| 3.9.10 | 5 / 2 | |
| 3.9.9 | 5 / 2 | |
| 3.9.8 | 5 / 2 | |
| 3.9.7 | 5 / 2 |
v3.9.11
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v3.9.10
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v3.9.9
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v3.9.8
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v3.9.7
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.