@wix/auto_sdk_blog_draft-posts
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | obfuscated-file:build/es/blog-v3-draft-draft-posts.universal-DE4EwIQq.d.mts | AI (source-diff): TypeScript declaration file with long re-export lines; standard Wix SDK bundler output, not obfuscation. | ai | |
| source-diff | obfuscated-file:build/internal/cjs/blog-v3-draft-draft-posts.universal-DE4EwIQq.d.ts | AI (source-diff): TypeScript declaration file with long re-export lines; standard Wix SDK bundler output, not obfuscation. | ai | |
| source-diff | obfuscated-file:build/cjs/blog-v3-draft-draft-posts.universal-DE4EwIQq.d.ts | AI (source-diff): TypeScript declaration file with long re-export lines; standard Wix SDK bundler output, not obfuscation. | ai | |
| source-diff | obfuscated-file:build/internal/es/blog-v3-draft-draft-posts.universal-DE4EwIQq.d.mts | AI (source-diff): TypeScript declaration file with long re-export lines; standard Wix SDK bundler output, not obfuscation. | ai | |
| source-diff | obfuscated-file:build/internal/cjs/blog-v3-draft-draft-posts.universal-yk8zFFHT.d.ts | AI (source-diff): Auto-generated TypeScript declaration file; long lines are re-exports, not obfuscation. | ai | |
| source-diff | obfuscated-file:build/es/blog-v3-draft-draft-posts.universal-yk8zFFHT.d.mts | AI (source-diff): Auto-generated TypeScript declaration file with long export lines; not obfuscation. | ai | |
| source-diff | obfuscated-file:build/internal/es/blog-v3-draft-draft-posts.universal-yk8zFFHT.d.mts | AI (source-diff): Auto-generated TypeScript declaration file with long export lines; not obfuscation. | ai | |
| source-diff | obfuscated-file:build/cjs/blog-v3-draft-draft-posts.universal-yk8zFFHT.d.ts | AI (source-diff): Auto-generated TypeScript declaration file; long lines are re-exports, not obfuscation. | ai | |
| source-diff | obfuscated-file:build/es/blog-v3-draft-draft-posts.universal-C8lvzfZY.d.mts | AI (source-diff): Auto-generated TS declaration file with long re-export lines; not obfuscation. Stable pattern for Wix SDK packages. | ai | |
| source-diff | obfuscated-file:build/internal/es/blog-v3-draft-draft-posts.universal-C8lvzfZY.d.mts | AI (source-diff): Same auto-generated TS declaration pattern; false positive for this package family. | ai | |
| source-diff | obfuscated-file:build/es/index.d.mts | AI (source-diff): Long re-export barrel file from SDK codegen; not obfuscation. | ai | |
| source-diff | obfuscated-file:build/internal/es/index.d.mts | AI (source-diff): Same barrel re-export pattern; false positive for this package family. | ai | |
| source-diff | obfuscated-file:build/internal/cjs/blog-v3-draft-draft-posts.universal-C8lvzfZY.d.ts | AI (source-diff): Same pattern as other declaration files; stable false positive for Wix SDK packages. | ai | |
| source-diff | obfuscated-file:build/cjs/blog-v3-draft-draft-posts.universal-C8lvzfZY.d.ts | AI (source-diff): Auto-generated CJS TS declaration; long lines from codegen, not obfuscation. | ai | |
| maintainer-change | maintainer-added | AI (maintainer-change): Wix internal team rotation via CI publisher; stable pattern for this org's SDK packages. | ai | |
| publish-pattern | new-deps-added | AI (publish-pattern): zod is a well-established schema validation library; addition aligns with new schema files in the diff. | ai | |
| maintainer-change | maintainer-removed | AI (maintainer-change): Wix internal team rotation; combined with trusted CI publisher, not a takeover signal. | ai | |
| source-diff | obfuscated-file:build/internal/blog-v3-draft-draft-posts.universal-yk8zFFHT.d.ts | AI (source-diff): Same pattern as .d.mts counterpart. | ai | |
| source-diff | obfuscated-file:build/blog-v3-draft-draft-posts.universal-yk8zFFHT.d.mts | AI (source-diff): TypeScript declaration file with long re-export lines; standard tsup bundler output for Wix auto-SDK packages. | ai | |
| source-diff | obfuscated-file:build/internal/blog-v3-draft-draft-posts.universal-yk8zFFHT.d.mts | AI (source-diff): Same pattern — .d.mts declaration file, not obfuscated code. | ai | |
| source-diff | obfuscated-file:build/blog-v3-draft-draft-posts.universal-yk8zFFHT.d.ts | AI (source-diff): TypeScript declaration file; long lines from bundled re-exports, not obfuscation. | ai | |
| source-diff | obfuscated-file:build/blog-v3-draft-draft-posts.universal-vVP72XfS.d.mts | AI (source-diff): Long-line TypeScript declaration file generated by tsup bundler; stable pattern for this Wix auto-SDK package. | ai | |
| source-diff | obfuscated-file:build/internal/index.d.ts | AI (source-diff): Same pattern; stable false positive for this package. | ai | |
| source-diff | obfuscated-file:build/index.d.ts | AI (source-diff): Bundled declaration file with long re-export line; standard for this Wix auto-SDK family. | ai | |
| source-diff | obfuscated-file:build/internal/blog-v3-draft-draft-posts.universal-vVP72XfS.d.ts | AI (source-diff): Same tsup-generated declaration file pattern; stable false positive. | ai | |
| source-diff | obfuscated-file:build/blog-v3-draft-draft-posts.universal-vVP72XfS.d.ts | AI (source-diff): tsup-generated .d.ts declaration file; long lines are re-exports, not obfuscation. | ai | |
| source-diff | obfuscated-file:build/internal/index.d.mts | AI (source-diff): Same pattern as build/index.d.mts; stable false positive for this package. | ai | |
| source-diff | obfuscated-file:build/index.d.mts | AI (source-diff): Bundled TypeScript declaration file with long re-export line; standard tsup output for Wix SDK packages. | ai | |
| source-diff | obfuscated-file:build/internal/blog-v3-draft-draft-posts.universal-vVP72XfS.d.mts | AI (source-diff): Same tsup-generated .d.mts declaration file pattern; not obfuscation. | ai | |
| npm-metadata | no-description | AI (npm-metadata): Stable pattern for Wix auto-generated SDK packages; not a malice indicator here. | ai | |
| bogus-package | bogus-package | AI (bogus-package): Wix auto-generated SDK package; templated name, no description/repo are expected patterns for this publisher's CI pipeline. | ai |
Versions (showing 67 of 67)
| Version | Deps | Published |
|---|---|---|
| 1.0.88 | 3 / 2 | |
| 1.0.87 | 3 / 2 | |
| 1.0.86 | 3 / 2 | |
| 1.0.85 | 3 / 2 | |
| 1.0.84 | 3 / 2 | |
| 1.0.83 | 3 / 2 | |
| 1.0.82 | 3 / 2 | |
| 1.0.81 | 3 / 2 | |
| 1.0.80 | 3 / 2 | |
| 1.0.79 | 3 / 2 | |
| 1.0.78 | 2 / 2 | |
| 1.0.77 | 2 / 2 | |
| 1.0.76 | 2 / 2 | |
| 1.0.75 | 2 / 2 | |
| 1.0.74 | 2 / 2 | |
| 1.0.73 | 2 / 2 | |
| 1.0.72 | 2 / 2 | |
| 1.0.71 | 2 / 2 | |
| 1.0.70 | 2 / 2 | |
| 1.0.69 | 2 / 2 | |
| 1.0.68 | 2 / 2 | |
| 1.0.67 | 2 / 2 | |
| 1.0.66 | 2 / 2 | |
| 1.0.65 | 2 / 2 | |
| 1.0.64 | 2 / 2 | |
| 1.0.63 | 2 / 2 | |
| 1.0.62 | 2 / 2 | |
| 1.0.61 | 2 / 2 | |
| 1.0.60 | 2 / 2 | |
| 1.0.59 | 2 / 2 | |
| 1.0.58 | 2 / 2 | |
| 1.0.57 | 2 / 2 | |
| 1.0.56 | 2 / 2 | |
| 1.0.55 | 2 / 2 | |
| 1.0.54 | 2 / 2 | |
| 1.0.53 | 2 / 2 | |
| 1.0.30 | 2 / 2 | |
| 1.0.29 | 2 / 2 | |
| 1.0.28 | 2 / 2 | |
| 1.0.27 | 2 / 2 | |
| 1.0.26 | 2 / 2 | |
| 1.0.25 | 2 / 2 | |
| 1.0.24 | 2 / 1 | |
| 1.0.23 | 2 / 1 | |
| 1.0.22 | 2 / 1 | |
| 1.0.21 | 2 / 1 | |
| 1.0.20 | 2 / 1 | |
| 1.0.19 | 2 / 1 | |
| 1.0.18 | 2 / 1 | |
| 1.0.17 | 2 / 1 | |
| 1.0.16 | 2 / 2 | |
| 1.0.15 | 2 / 1 | |
| 1.0.14 | 2 / 1 | |
| 1.0.13 | 2 / 1 | |
| 1.0.12 | 2 / 1 | |
| 1.0.11 | 2 / 1 | |
| 1.0.10 | 2 / 1 | |
| 1.0.9 | 2 / 1 | |
| 1.0.8 | 2 / 1 | |
| 1.0.7 | 2 / 1 | |
| 1.0.6 | 2 / 1 | |
| 1.0.5 | 2 / 1 | |
| 1.0.4 | 2 / 1 | |
| 1.0.3 | 2 / 1 | |
| 1.0.2 | 2 / 1 | |
| 1.0.1 | 2 / 1 | |
| 1.0.0 | 2 / 1 |
v1.0.79
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.78
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.77
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.76
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.75
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.74
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.73
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.72
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.71
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.70
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.69
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.68
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.67
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.66
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.65
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.64
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.63
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.62
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.61
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.60
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.59
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.58
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.57
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.56
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.55
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.54
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.14
2 findingsThis version was published by a different npm account (roir-wix) than the most recent previously approved version (wix-ci-publisher) on 2025-04-28. It has since remained available on npm for 445 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.13
2 findingsThis version was published by a different npm account (roir-wix) than the most recent previously approved version (wix-ci-publisher) on 2025-04-28. It has since remained available on npm for 445 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.12
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.11
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.10
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.9
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.8
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.7
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.6
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.5
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.4
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.3
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.