@zuplo/otel
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| phantom-deps | phantom-dep:ts-checked-fsm | AI (phantom-deps): ts-checked-fsm is a declared dependency used in build config; phantom-dep false positive for this bundled package. | ai | |
| bogus-package | bogus-package | AI (bogus-package): Internal utility package in a large corporate monorepo; missing README/keywords/description is consistent with the package's nature across all 1493 versions. | ai | |
| phantom-deps | phantom-dep:@opentelemetry/api-logs | AI (phantom-deps): Package bundles its deps into ESM output; @opentelemetry/api-logs is declared in dependencies. Not a true phantom dep. | ai | |
| phantom-deps | phantom-dep:@opentelemetry/resources | AI (phantom-deps): Package bundles its deps into ESM output; @opentelemetry/resources is declared in dependencies. Not a true phantom dep. | ai | |
| phantom-deps | phantom-dep:@opentelemetry/otlp-transformer | AI (phantom-deps): Package bundles its deps into ESM output; @opentelemetry/otlp-transformer is declared in dependencies. Not a true phantom dep. | ai | |
| semgrep | semgrep:api-obfuscation-reflect | AI (semgrep): Fired on standard bundler output (esbuild/rollup minification). The sample shows Object.defineProperty for function naming, not malicious Reflect.get() usage. False positive for this bundled package. | ai | |
| phantom-deps | phantom-dep:@opentelemetry/semantic-conventions | AI (phantom-deps): Package bundles its deps into ESM output; @opentelemetry/semantic-conventions is declared in dependencies. Not a true phantom dep. | ai | |
| phantom-deps | phantom-dep:@opentelemetry/exporter-trace-otlp-http | AI (phantom-deps): Package bundles its deps into ESM output; @opentelemetry/exporter-trace-otlp-http is declared in dependencies. Not a true phantom dep. | ai | |
| phantom-deps | phantom-dep:@opentelemetry/otlp-exporter-base | AI (phantom-deps): Package bundles its deps into ESM output; @opentelemetry/otlp-exporter-base is declared in dependencies. Not a true phantom dep. | ai | |
| phantom-deps | phantom-dep:@opentelemetry/core | AI (phantom-deps): Package bundles its deps into ESM output; @opentelemetry/core is declared in dependencies. Not a true phantom dep. | ai |
Versions (showing 100 of 1090)
| Version | Deps | Published |
|---|---|---|
| 6.51.40 | 8 / 2 | |
| 6.51.39 | 8 / 2 | |
| 6.51.38 | 8 / 2 | |
| 6.51.37 | 8 / 2 | |
| 6.51.36 | 8 / 2 | |
| 6.51.35 | 8 / 2 | |
| 6.51.34 | 8 / 2 | |
| 6.51.33 | 9 / 2 | |
| 6.51.32 | 9 / 2 | |
| 6.51.31 | 9 / 2 | |
| 6.51.30 | 9 / 2 | |
| 6.51.29 | 9 / 2 | |
| 6.51.28 | 9 / 2 | |
| 6.51.27 | 9 / 2 | |
| 6.51.26 | 9 / 2 | |
| 6.51.25 | 9 / 2 | |
| 6.51.24 | 9 / 2 | |
| 6.51.23 | 9 / 2 | |
| 6.51.22 | 9 / 2 | |
| 6.51.21 | 9 / 2 | |
| 6.51.20 | 9 / 2 | |
| 6.51.19 | 9 / 2 | |
| 6.51.17 | 9 / 2 | |
| 6.51.16 | 9 / 2 | |
| 6.51.15 | 9 / 2 | |
| 6.51.14 | 9 / 2 | |
| 6.51.13 | 9 / 2 | |
| 6.51.12 | 9 / 2 | |
| 6.51.11 | 9 / 2 | |
| 6.51.10 | 9 / 2 | |
| 6.51.9 | 9 / 2 | |
| 6.51.7 | 9 / 2 | |
| 6.51.6 | 9 / 2 | |
| 6.51.5 | 9 / 2 | |
| 6.51.4 | 9 / 2 | |
| 6.51.3 | 9 / 2 | |
| 6.51.2 | 9 / 2 | |
| 6.51.1 | 9 / 2 | |
| 6.51.0 | 9 / 2 | |
| 6.50.16 | 9 / 2 | |
| 6.50.14 | 9 / 2 | |
| 6.50.13 | 9 / 2 | |
| 6.50.12 | 9 / 2 | |
| 6.50.11 | 9 / 2 | |
| 6.50.10 | 9 / 2 | |
| 6.50.9 | 9 / 2 | |
| 6.50.8 | 9 / 2 | |
| 6.50.7 | 9 / 2 | |
| 6.50.6 | 9 / 2 | |
| 6.50.5 | 9 / 2 | |
| 6.50.4 | 9 / 2 | |
| 6.50.2 | 9 / 2 | |
| 6.50.1 | 9 / 2 | |
| 6.50.0 | 9 / 2 | |
| 6.49.12 | 9 / 2 | |
| 6.49.11 | 9 / 2 | |
| 6.49.9 | 9 / 2 | |
| 6.49.8 | 9 / 2 | |
| 6.49.7 | 9 / 2 | |
| 6.49.6 | 9 / 2 | |
| 6.49.5 | 9 / 2 | |
| 6.49.4 | 9 / 2 | |
| 6.49.3 | 9 / 2 | |
| 6.49.2 | 9 / 2 | |
| 6.49.0 | 9 / 2 | |
| 6.48.21 | 9 / 2 | |
| 6.48.19 | 9 / 2 | |
| 6.48.18 | 9 / 2 | |
| 6.48.17 | 9 / 2 | |
| 6.48.15 | 9 / 2 | |
| 6.48.14 | 9 / 2 | |
| 6.48.13 | 9 / 2 | |
| 6.48.12 | 9 / 2 | |
| 6.48.11 | 9 / 2 | |
| 6.48.7 | 9 / 2 | |
| 6.48.6 | 9 / 2 | |
| 6.48.5 | 9 / 2 | |
| 6.48.4 | 9 / 2 | |
| 6.48.3 | 9 / 2 | |
| 6.48.2 | 9 / 2 | |
| 6.48.1 | 9 / 2 | |
| 6.48.0 | 9 / 2 | |
| 6.47.12 | 9 / 2 | |
| 6.47.11 | 9 / 2 | |
| 6.47.10 | 9 / 2 | |
| 6.47.9 | 9 / 2 | |
| 6.47.8 | 9 / 2 | |
| 6.47.7 | 9 / 2 | |
| 6.47.6 | 9 / 2 | |
| 6.47.5 | 9 / 2 | |
| 6.47.4 | 9 / 2 | |
| 6.47.3 | 9 / 2 | |
| 6.47.2 | 9 / 2 | |
| 6.47.1 | 9 / 2 | |
| 6.47.0 | 9 / 2 | |
| 6.46.4 | 9 / 2 | |
| 6.46.3 | 9 / 2 | |
| 6.46.2 | 9 / 2 | |
| 6.46.1 | 9 / 2 | |
| 6.46.0 | 9 / 2 |
v6.51.33
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.51.32
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.51.31
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.51.30
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.51.29
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.51.28
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.51.27
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.51.26
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.51.25
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.51.24
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.51.23
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.51.22
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.51.21
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.51.20
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.51.19
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.51.17
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.51.16
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.51.15
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.51.13
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.51.12
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.51.11
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.51.10
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.51.7
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.51.6
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.51.3
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.51.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.51.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.50.16
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.50.12
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.50.11
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.50.10
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.50.8
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.50.7
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.50.6
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.50.5
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.50.4
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.50.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.50.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.50.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.49.11
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.49.9
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.49.8
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.49.6
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.49.3
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.49.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.49.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.48.21
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.48.19
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.48.18
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.48.17
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.48.15
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.48.14
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.48.13
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.48.12
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.48.11
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.48.7
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.48.6
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.48.5
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.48.4
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.48.3
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.48.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.48.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.48.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.47.12
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.47.11
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.47.10
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.47.9
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.47.8
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.47.7
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.47.6
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.47.5
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.47.4
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.47.3
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.47.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.47.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.47.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.46.4
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.46.3
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.46.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.46.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.46.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.