@windyroad/risk-scorer
Pipeline risk scoring, commit/push gates, and secret leak detection
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Keywords
Versions (showing 6 of 6)
| Version | Deps | Published |
|---|---|---|
| 0.17.3 | 0 / 0 | |
| 0.17.0 | 0 / 0 | |
| 0.4.1 | 0 / 0 | |
| 0.2.0 | 0 / 0 | |
| 0.1.2 | 0 / 0 | |
| 0.1.1 | 0 / 0 |
v0.17.3
1 findingThis version was published without provenance, but prior versions were published via CI/CD with attestations. This is a strong signal of a potential account compromise or unauthorized publish. Multiple high-profile registry compromises have exhibited exactly this pattern.
v0.17.0
1 finding[Reject — re-review on republish] (prior reject: AI (provenance): Regressed provenance is a strong supply chain compromise signal for this package; all future versions without attestation should be rejected until the pattern is re-established.) This version was published without provenance, but prior versions were published via CI/CD with attestations. This is a strong signal of a potential account compromise or unauthorized publish. Multiple high-profile registry compromises have exhibited exactly this pattern.