@ydbjs/core
13
Versions
—
License
No
Install Scripts
Verified
Provenance
Supply chain provenance
Status for the latest visible version.
SLSA provenance attestation
npm registry signatures
gitHead linked
Maintainers
ydb-platform
Keywords
coredatabasedrivergrpctypescriptydb
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| provenance | publisher-changed | AI (provenance): Transition to GitHub Actions publisher is consistent with CI/CD migration; SLSA attestation from official ydb-platform org confirms legitimacy. | ai | |
| publish-pattern | dormant-publish | AI (publish-pattern): Dormancy followed by CI/CD-attested publish from official org; not indicative of takeover. | ai | |
| phantom-deps | phantom-dep:debug | AI (phantom-deps): debug is listed as a runtime dependency in package.json; phantom-dep heuristic misfires here. | ai | |
| typosquat | typosquat.levenshtein:cors | AI (typosquat): Scoped @ydbjs/core is the official YDB JS SDK core package, not a typo of cors; Levenshtein match is coincidental. | ai |