← Home

@xapp/stentor-service-generative-ai

npm

Generative AI Service

100
Versions
Apache-2.0
License
No
Install Scripts
Missing
Provenance

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.

Maintainers

michaelmyersxappbot

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
maintainer-change maintainer-removed AI (maintainer-change): Consistent with CI-based publish migration, not takeover indicators. ai
source-diff large-new-source-files AI (source-diff): Build/tsc output expansion, no malicious payload evidence. ai
publish-pattern new-deps-added AI (publish-pattern): New deps are contextually appropriate for a generative AI service; same-org and well-known tokenizer package. ai
dependencies unvetted-dep:@xapp/arachne-utils AI (dependencies): Same-org @xapp scoped package; consistent with publisher's ecosystem pattern. ai
provenance no-provenance AI (provenance): Consistent across all @xapp/stentor-* packages; org does not use Sigstore attestation. ai

Versions (showing 100 of 167)

Version Deps Published
1.89.1 1 / 12
1.89.0 1 / 12
1.85.1 1 / 12
1.83.0 1 / 12
1.80.3 1 / 12
1.78.5 1 / 12
1.78.2 1 / 12
1.78.0 1 / 12
1.77.2 1 / 12
1.77.0 1 / 12
1.76.22 1 / 12
1.76.20 1 / 12
1.76.16 1 / 12
1.76.12 1 / 12
1.76.10 1 / 12
1.76.9 1 / 12
1.76.6 1 / 12
1.76.5 1 / 12
1.76.4 1 / 12
1.76.1 1 / 12
1.74.23 1 / 12
1.74.22 1 / 12
1.74.18 2 / 12
1.74.14 2 / 12
1.74.9 2 / 12
1.74.0 2 / 12
1.73.19 2 / 12
1.73.11 2 / 12
1.73.6 2 / 12
1.73.3 2 / 12
1.73.0 2 / 12
1.72.11 2 / 12
1.72.8 2 / 12
1.72.7 2 / 12
1.72.4 2 / 12
1.72.3 2 / 12
1.72.1 2 / 12
1.71.29 2 / 12
1.71.27 2 / 12
1.71.24 2 / 12
1.71.23 2 / 12
1.71.21 2 / 12
1.71.18 2 / 12
1.71.12 2 / 12
1.71.11 2 / 12
1.71.9 2 / 12
1.71.8 2 / 12
1.71.4 2 / 12
1.71.1 2 / 12
1.70.50 2 / 12
1.70.49 2 / 12
1.70.47 2 / 12
1.70.46 2 / 12
1.70.44 2 / 12
1.70.38 2 / 12
1.70.35 2 / 12
1.70.31 2 / 12
1.70.19 2 / 12
1.70.18 2 / 12
1.70.16 2 / 12
1.70.13 2 / 12
1.70.10 2 / 12
1.70.9 2 / 12
1.70.8 2 / 12
1.70.6 2 / 12
1.70.5 2 / 12
1.70.3 2 / 12
1.69.4 2 / 12
1.69.3 2 / 12
1.69.2 2 / 12
1.69.1 2 / 12
1.69.0 2 / 12
1.68.1 2 / 12
1.67.0 2 / 12
1.66.10 2 / 12
1.66.9 2 / 12
1.66.8 2 / 12
1.66.6 2 / 12
1.66.4 2 / 12
1.66.3 2 / 12
1.66.2 2 / 12
1.66.0 2 / 12
1.65.43 2 / 12
1.65.42 2 / 12
1.65.41 0 / 11
1.65.40 0 / 11
1.65.39 0 / 11
1.65.38 0 / 11
1.65.35 0 / 11
1.65.34 0 / 11
1.65.33 0 / 11
1.65.31 0 / 11
1.65.29 0 / 11
1.65.28 0 / 11
1.65.27 0 / 11
1.65.26 0 / 11
1.65.21 0 / 11
1.65.20 0 / 11
1.65.17 0 / 11
1.65.16 0 / 11
Showing 100 of 167 Next page →

v1.89.1

2 findings
HIGH Publisher changed: michaelmyers → GitHub Actions (on 2026-07-11) provenance

This version was published by a different npm account than previous versions on 2026-07-11. This could indicate a legitimate maintainer transition or an account compromise.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.89.0

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.65.17

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.65.16

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.