@xyo-network/witness
7
Versions
—
License
No
Install Scripts
Missing
Provenance
Supply chain provenance
Status for the latest visible version.
No SLSA provenance
npm registry signatures
No source commit
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
atrouwjoelbcarterrphansen91jordantrouwjonesmac
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| provenance | missing-githead | AI (provenance): Large active monorepo; occasional gitHead absence is a CI config artifact, not a takeover indicator given publisher track record. | ai | |
| publish-pattern | dormant-publish | AI (publish-pattern): Large monorepo with 1214 versions; dormancy likely reflects release cadence, not account takeover. | ai | |
| bogus-package | bogus-package | AI (bogus-package): Established XYO Network SDK package; sparse README/keywords are a style choice, not spam indicators. | ai | |
| provenance | publisher-changed | AI (provenance): Transition to org account 'xyo' with strong track record; consistent with org consolidation for this established package. | ai | |
| dependencies | unvetted-dep:@xyo-network/witness-abstract | AI (dependencies): Same-org sibling package at matching version; standard monorepo split pattern for xyo-network. | ai | |
| dependencies | unvetted-dep:@xyo-network/witness-wrapper | AI (dependencies): Same-org sibling package at matching version; standard monorepo split pattern for xyo-network. | ai | |
| dependencies | unvetted-dep:@xyo-network/witness-model | AI (dependencies): Same-org sibling package at matching version; standard monorepo split pattern for xyo-network. | ai | |
| provenance | no-provenance | AI (provenance): Large established monorepo; provenance not historically used by this publisher across 1212 versions. | ai |