@wix/metro-runtime
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| provenance | publisher-changed | AI (provenance): wix-ci-publisher is a well-established Wix CI account (798 approved); publisher change reflects org-wide CI migration, not compromise. | ai | |
| source-diff | encoded-string-file:dist/cjs/proto/index.js | AI (source-diff): Long string is a minified protobuf/JSON schema descriptor, not an obfuscated payload; stable pattern for this package. | ai | |
| source-diff | encoded-string-file:src/proto/index.js | AI (source-diff): Long strings are protobuf schema JSON data, not encoded payloads. | ai | |
| source-diff | obfuscated-file:es/build/proto/index.js | AI (source-diff): Same minified protobuf schema bundle (ES module variant); not obfuscated malware. | ai | |
| source-diff | obfuscated-file:cjs/build/proto/index.js | AI (source-diff): Minified protobuf schema bundle generated by Wix proto toolchain; not obfuscated malware. | ai | |
| bogus-package | bogus-package | AI (bogus-package): Private internal Wix package; missing metadata is expected for scoped internal packages. | ai | |
| npm-metadata | no-description | AI (npm-metadata): Private internal package; no public description needed. | ai |
Versions (showing 100 of 599)
| Version | Deps | Published |
|---|---|---|
| 1.2121.0 | 7 / 15 | |
| 1.2120.0 | 7 / 15 | |
| 1.2119.0 | 7 / 15 | |
| 1.2118.0 | 7 / 15 | |
| 1.2117.0 | 7 / 15 | |
| 1.2116.0 | 7 / 15 | |
| 1.2115.0 | 7 / 15 | |
| 1.2114.0 | 7 / 14 | |
| 1.2113.0 | 7 / 14 | |
| 1.2112.0 | 7 / 14 | |
| 1.2110.0 | 7 / 14 | |
| 1.2109.0 | 7 / 14 | |
| 1.2108.0 | 7 / 14 | |
| 1.2107.0 | 7 / 14 | |
| 1.2106.0 | 7 / 14 | |
| 1.2105.0 | 7 / 14 | |
| 1.2104.0 | 7 / 14 | |
| 1.2103.0 | 7 / 14 | |
| 1.2102.0 | 7 / 14 | |
| 1.2101.0 | 7 / 14 | |
| 1.2100.0 | 7 / 14 | |
| 1.2099.0 | 7 / 14 | |
| 1.2098.0 | 7 / 14 | |
| 1.2097.0 | 7 / 14 | |
| 1.2096.0 | 7 / 14 | |
| 1.2095.0 | 7 / 14 | |
| 1.2094.0 | 7 / 14 | |
| 1.2093.0 | 7 / 14 | |
| 1.2092.0 | 7 / 14 | |
| 1.2091.0 | 7 / 14 | |
| 1.2090.0 | 7 / 14 | |
| 1.2089.0 | 7 / 14 | |
| 1.2088.0 | 7 / 14 | |
| 1.2087.0 | 7 / 14 | |
| 1.2086.0 | 7 / 14 | |
| 1.2085.0 | 7 / 14 | |
| 1.2084.0 | 7 / 14 | |
| 1.2083.0 | 7 / 14 | |
| 1.2082.0 | 7 / 14 | |
| 1.2081.0 | 7 / 14 | |
| 1.2080.0 | 7 / 14 | |
| 1.2079.0 | 7 / 14 | |
| 1.2078.0 | 7 / 14 | |
| 1.2077.0 | 7 / 14 | |
| 1.2076.0 | 7 / 14 | |
| 1.2075.0 | 7 / 14 | |
| 1.2074.0 | 7 / 14 | |
| 1.2073.0 | 7 / 14 | |
| 1.2072.0 | 7 / 14 | |
| 1.2071.0 | 7 / 14 | |
| 1.2070.0 | 7 / 14 | |
| 1.2069.0 | 7 / 14 | |
| 1.2068.0 | 7 / 14 | |
| 1.2067.0 | 7 / 14 | |
| 1.2066.0 | 7 / 14 | |
| 1.2065.0 | 7 / 14 | |
| 1.2064.0 | 7 / 14 | |
| 1.2063.0 | 7 / 14 | |
| 1.2061.0 | 7 / 14 | |
| 1.2060.0 | 7 / 14 | |
| 1.2058.0 | 7 / 14 | |
| 1.2057.0 | 7 / 14 | |
| 1.2053.0 | 7 / 14 | |
| 1.2018.0 | 7 / 14 | |
| 1.2012.0 | 7 / 14 | |
| 1.2011.0 | 7 / 14 | |
| 1.2010.0 | 7 / 14 | |
| 1.2009.0 | 7 / 14 | |
| 1.2007.0 | 7 / 14 | |
| 1.2005.0 | 7 / 14 | |
| 1.2003.0 | 7 / 14 | |
| 1.1989.0 | 7 / 14 | |
| 1.1987.0 | 7 / 14 | |
| 1.1986.0 | 7 / 14 | |
| 1.1985.0 | 7 / 14 | |
| 1.1978.0 | 7 / 14 | |
| 1.1973.0 | 7 / 14 | |
| 1.1972.0 | 7 / 14 | |
| 1.1971.0 | 7 / 14 | |
| 1.1970.0 | 7 / 14 | |
| 1.1969.0 | 7 / 14 | |
| 1.1968.0 | 7 / 14 | |
| 1.1967.0 | 7 / 14 | |
| 1.1966.0 | 7 / 14 | |
| 1.1965.0 | 7 / 14 | |
| 1.1964.0 | 7 / 14 | |
| 1.1963.0 | 7 / 14 | |
| 1.1962.0 | 7 / 14 | |
| 1.1961.0 | 7 / 14 | |
| 1.1960.0 | 7 / 14 | |
| 1.1959.0 | 7 / 14 | |
| 1.1958.0 | 7 / 14 | |
| 1.1957.0 | 7 / 14 | |
| 1.1956.0 | 7 / 14 | |
| 1.1955.0 | 7 / 14 | |
| 1.1954.0 | 7 / 14 | |
| 1.1953.0 | 7 / 14 | |
| 1.1952.0 | 7 / 14 | |
| 1.1951.0 | 7 / 14 | |
| 1.1950.0 | 7 / 14 |
v1.2121.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.1969.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.1968.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.1967.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.1966.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.1965.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.1964.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.1963.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.1962.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.1961.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.1960.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.1959.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.1958.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.1957.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.1956.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.1955.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.1954.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.1953.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.1952.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.1951.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.1950.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.