@xapp/stentor-intelligent-search-channel
Intelligent Search Channel for stentor 📣
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| provenance | publisher-changed | AI (provenance): CI/CD publish switch with no code/dep changes vs prior approved version. | ai | |
| maintainer-change | maintainer-removed | AI (maintainer-change): Consistent with org migrating to automated CI publishing, no malicious diff. | ai | |
| provenance | no-provenance | AI (provenance): Mature package with 71 versions; no provenance is consistent across the entire stentor ecosystem. | ai | |
| bogus-package | bogus-package | AI (bogus-package): Internal monorepo package with 71 published versions; sparse metadata is a stable pattern, not spam. | ai | |
| phantom-deps | phantom-dep:stentor-guards | AI (phantom-deps): Declared dep used in config/build tooling; phantom-dep heuristic is a stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:stentor-constants | AI (phantom-deps): Same as stentor-guards; config-referenced dep, stable false positive. | ai |
Versions (showing 74 of 74)
| Version | Deps | Published |
|---|---|---|
| 1.94.1 | 2 / 11 | |
| 1.94.0 | 2 / 11 | |
| 1.91.0 | 2 / 11 | |
| 1.88.0 | 2 / 11 | |
| 1.87.1 | 2 / 11 | |
| 1.87.0 | 2 / 11 | |
| 1.85.0 | 2 / 11 | |
| 1.82.1 | 2 / 11 | |
| 1.81.5 | 2 / 11 | |
| 1.81.1 | 2 / 11 | |
| 1.81.0 | 2 / 11 | |
| 1.80.0 | 2 / 11 | |
| 1.79.0 | 2 / 11 | |
| 1.78.0 | 2 / 11 | |
| 1.77.0 | 2 / 11 | |
| 1.76.1 | 2 / 11 | |
| 1.76.0 | 2 / 11 | |
| 1.74.7 | 2 / 11 | |
| 1.74.6 | 2 / 11 | |
| 1.74.5 | 2 / 11 | |
| 1.74.1 | 2 / 11 | |
| 1.74.0 | 2 / 11 | |
| 1.73.0 | 2 / 11 | |
| 1.72.4 | 2 / 11 | |
| 1.72.3 | 2 / 11 | |
| 1.72.1 | 2 / 11 | |
| 1.71.0 | 2 / 11 | |
| 1.65.6 | 2 / 11 | |
| 1.62.0 | 2 / 11 | |
| 1.57.1 | 2 / 11 | |
| 1.54.2 | 2 / 11 | |
| 1.54.1 | 2 / 11 | |
| 1.54.0 | 2 / 11 | |
| 1.53.2 | 2 / 11 | |
| 1.53.1 | 2 / 11 | |
| 1.53.0 | 2 / 11 | |
| 1.49.3 | 2 / 11 | |
| 1.49.2 | 2 / 11 | |
| 1.48.0 | 2 / 11 | |
| 1.47.2 | 2 / 11 | |
| 1.47.0 | 2 / 11 | |
| 1.46.4 | 2 / 11 | |
| 1.46.2 | 2 / 11 | |
| 1.46.1 | 2 / 11 | |
| 1.44.0 | 2 / 11 | |
| 1.43.1 | 2 / 11 | |
| 1.43.0 | 2 / 11 | |
| 1.42.5 | 2 / 11 | |
| 1.42.4 | 2 / 11 | |
| 1.42.2 | 2 / 11 | |
| 1.42.1 | 2 / 11 | |
| 1.41.3 | 2 / 11 | |
| 1.41.2 | 2 / 11 | |
| 1.41.1 | 2 / 11 | |
| 1.41.0 | 2 / 11 | |
| 1.40.3 | 2 / 11 | |
| 1.40.2 | 2 / 11 | |
| 1.40.0 | 2 / 11 | |
| 1.39.0 | 2 / 11 | |
| 1.38.0 | 2 / 11 | |
| 1.37.4 | 2 / 11 | |
| 1.37.2 | 2 / 11 | |
| 1.37.0 | 2 / 11 | |
| 1.36.8 | 2 / 11 | |
| 1.36.6 | 2 / 11 | |
| 1.36.2 | 2 / 11 | |
| 1.36.1 | 2 / 11 | |
| 1.36.0 | 2 / 11 | |
| 1.35.1 | 2 / 11 | |
| 1.35.0 | 2 / 11 | |
| 1.32.0 | 2 / 11 | |
| 1.31.0 | 2 / 11 | |
| 1.30.0 | 2 / 11 | |
| 1.29.2 | 2 / 11 |
v1.94.1
2 findingsThis version was published by a different npm account than previous versions on 2026-07-22. This could indicate a legitimate maintainer transition or an account compromise.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.76.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.74.7
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.74.6
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.74.5
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.74.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.74.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.73.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.72.4
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.72.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.72.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.71.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.65.6
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.62.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.57.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.54.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.54.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.54.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.53.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.53.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.53.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.49.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.49.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.48.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.47.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.47.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.46.4
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.46.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.46.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.44.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.43.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.43.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.42.5
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.42.4
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.42.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.42.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.41.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.41.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.41.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.41.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.40.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.40.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.40.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.39.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.38.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.37.4
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.37.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.37.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.36.8
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.36.6
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.36.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.36.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.36.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.35.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.35.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.32.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.31.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.30.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.29.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.