@xen-orchestra/web-core
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| npm-metadata | no-description | AI (npm-metadata): Long-standing monorepo sub-package; missing description is cosmetic. | ai | |
| source-diff | large-new-source-files | AI (source-diff): Normal feature growth in active monorepo package, no injected code evidence. | ai | |
| phantom-deps | phantom-dep:d3-time-format | AI (phantom-deps): Framework-config referenced, not malicious. | ai | |
| phantom-deps | phantom-dep:@vueuse/math | AI (phantom-deps): Framework-config referenced, not malicious. | ai | |
| provenance | publisher-changed | AI (provenance): Trusted co-maintainer within same monorepo org, strong track record. | ai | |
| maintainer-change | maintainer-added | AI (maintainer-change): Team maintainers added for monorepo package, consistent with prior approvals. | ai | |
| dependencies | unvetted-dep:placement.js | AI (dependencies): Sibling package from same Vates/Xen Orchestra monorepo ecosystem. | ai | |
| publish-pattern | new-deps-added | AI (publish-pattern): Standard UI libraries added for legitimate feature work, no supply-chain concern. | ai | |
| phantom-deps | phantom-dep:@vueuse/shared | AI (phantom-deps): Peer/transitive usage pattern in Vue ecosystem; stable false positive. | ai | |
| phantom-deps | phantom-dep:@fortawesome/free-regular-svg-icons | AI (phantom-deps): Icon set loaded via config; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:@fortawesome/free-solid-svg-icons | AI (phantom-deps): Icon set loaded via config; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:@regle/schemas | AI (phantom-deps): Config-file-only reference pattern consistent with other accepted phantom deps in this package. | ai | |
| phantom-deps | phantom-dep:echarts | AI (phantom-deps): Font/chart deps loaded by convention in Vue build tooling; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:@fortawesome/vue-fontawesome | AI (phantom-deps): Config-referenced Vue plugin; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:@types/d3-time-format | AI (phantom-deps): Type-only package loaded by framework convention; stable false positive. | ai | |
| phantom-deps | phantom-dep:vue-virtual-scroller | AI (phantom-deps): Config-referenced dep; stable false positive for this Vue UI library. | ai | |
| phantom-deps | phantom-dep:@fontsource/poppins | AI (phantom-deps): Font package loaded by convention; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:iterable-backoff | AI (phantom-deps): Config-referenced dep; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:@novnc/novnc | AI (phantom-deps): Referenced in config/type declarations; stable false positive for this UI library. | ai |
Versions (showing 23 of 23)
| Version | Deps | Published |
|---|---|---|
| 0.57.0 | 27 / 7 | |
| 0.54.0 | 26 / 7 | |
| 0.51.0 | 23 / 7 | |
| 0.50.0 | 23 / 7 | |
| 0.49.0 | 23 / 7 | |
| 0.47.0 | 23 / 7 | |
| 0.45.0 | 23 / 7 | |
| 0.42.0 | 21 / 7 | |
| 0.39.1 | 21 / 7 | |
| 0.39.0 | 21 / 7 | |
| 0.34.0 | 21 / 7 | |
| 0.31.0 | 20 / 7 | |
| 0.24.0 | 19 / 7 | |
| 0.20.1 | 18 / 7 | |
| 0.20.0 | 18 / 7 | |
| 0.12.0 | 17 / 7 | |
| 0.8.0 | 12 / 7 | |
| 0.7.0 | 11 / 7 | |
| 0.6.0 | 11 / 7 | |
| 0.0.4 | 11 / 7 | |
| 0.0.3 | 11 / 7 | |
| 0.0.2 | 0 / 18 | |
| 0.0.1 | 0 / 13 |
v0.57.0
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (mathieura) than the most recent previously approved version (pierre.brunet289) on 2026-07-27, but mathieura is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v0.12.0
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (b-nollet) than the most recent previously approved version (pdonias) on 2025-01-30, but b-nollet is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v0.8.0
2 findingsThis version was published by a different npm account than previous versions on 2024-12-16. This could indicate a legitimate maintainer transition or an account compromise.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.7.0
2 findingsThis version was published by a different npm account than previous versions on 2024-11-28. This could indicate a legitimate maintainer transition or an account compromise.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.6.0
2 findingsThis version was published by a different npm account than previous versions on 2024-11-27. This could indicate a legitimate maintainer transition or an account compromise.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.4
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (b-nollet) than the most recent previously approved version (pdonias) on 2024-07-25, but b-nollet is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v0.0.3
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (mathieura) than the most recent previously approved version (pdonias) on 2024-06-27, but mathieura is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v0.0.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.0.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.