← Home

@wisemen/quantity

npm Repository Homepage
33
Versions
—
License
No
Install Scripts
Verified
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures No source commit

Maintainers

wouter.appwisekobe-kwanten-wisemenjorenvandeweyerrobbe95fullmetaljsmaartensijmkenswisemen-sysopspeethadaanpersoonsjonasvannieuwenhuijsenyuhanghujonasbeckerssebastiaanvanspauwenjeroen-vc

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
provenance missing-githead AI (provenance): GitHub Actions CI publish pipeline may not inject gitHead; SLSA provenance attestation provides equivalent commit traceability. ai
provenance publisher-changed AI (provenance): Both publishers are part of the wisemen-digital org; jonasbeckers has strong track record (87 approved, 0 rejected). ai
phantom-deps phantom-dep:@wisemen/nestjs-typeorm AI (phantom-deps): Same-org runtime dependency; declared correctly in dependencies, not a phantom dep concern. ai

Versions (showing 33 of 33)

Version Deps Published
0.9.1 1 / 7
0.9.0 1 / 7
0.8.4 1 / 7
0.8.3 1 / 7
0.8.2 1 / 7
0.8.1 1 / 4
0.8.0 1 / 4
0.7.0 1 / 4
0.6.1 1 / 4
0.6.0 1 / 4
0.5.0 0 / 4
0.4.1 1 / 4
0.4.0 0 / 4
0.3.6 0 / 4
0.3.5 0 / 4
0.3.4 0 / 4
0.3.3 0 / 4
0.3.2 0 / 4
0.3.1 0 / 4
0.3.0 0 / 4
0.2.2 0 / 4
0.2.1 0 / 4
0.2.0 0 / 4
0.1.0 0 / 4
0.0.9 0 / 4
0.0.8 0 / 4
0.0.7 0 / 4
0.0.6 0 / 4
0.0.5 0 / 4
0.0.4 0 / 4
0.0.3 0 / 4
0.0.2 0 / 4
0.0.1 0 / 4

v0.9.1

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.