altair-express-middleware
Express middleware for altair graphql client
Supply chain provenance
Status for the latest visible version.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| email-domain | unclaimed-email:sirmuel.design | AI (email-domain): Mitigated by SLSA provenance attestation; package has 236 versions and 2997-day history in the altair-graphql org. | ai | |
| provenance | slsa-provenance | AI (provenance): Consistent CI/CD provenance attestation; stable signal for this package. | ai | |
| dependencies | unvetted-dep:altair-static | AI (dependencies): altair-static is a sibling package in the same altair-graphql monorepo, pinned to the same version. | ai |
Versions (showing 19 of 19)
| Version | Deps | Published |
|---|---|---|
| 8.5.7 | 2 / 6 | |
| 8.5.6 | 2 / 6 | |
| 8.5.5 | 2 / 6 | |
| 8.5.4 | 2 / 6 | |
| 8.5.3 | 2 / 6 | |
| 8.5.2 | 2 / 6 | |
| 8.5.1 | 2 / 6 | |
| 8.5.0 | 2 / 6 | |
| 8.4.4 | 2 / 6 | |
| 8.4.3 | 2 / 6 | |
| 8.4.2 | 2 / 6 | |
| 8.4.1 | 2 / 6 | |
| 8.4.0 | 2 / 6 | |
| 8.3.0 | 2 / 6 | |
| 8.2.8 | 2 / 6 | |
| 8.2.7 | 2 / 6 | |
| 8.2.5 | 2 / 6 | |
| 8.2.4 | 2 / 6 | |
| 8.2.3 | 2 / 6 |
v8.5.7
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v8.5.6
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v8.5.5
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v8.5.4
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v8.5.3
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v8.5.1
2 findingsMaintainer email '[email protected]' uses domain 'sirmuel.design' which has no DNS records. An attacker could register this domain to hijack the maintainer identity.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v8.5.0
2 findingsMaintainer email '[email protected]' uses domain 'sirmuel.design' which has no DNS records. An attacker could register this domain to hijack the maintainer identity.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v8.4.4
2 findingsMaintainer email '[email protected]' uses domain 'sirmuel.design' which has no DNS records. An attacker could register this domain to hijack the maintainer identity.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v8.4.3
2 findingsMaintainer email '[email protected]' uses domain 'sirmuel.design' which has no DNS records. An attacker could register this domain to hijack the maintainer identity.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v8.4.2
2 findingsMaintainer email '[email protected]' uses domain 'sirmuel.design' which has no DNS records. An attacker could register this domain to hijack the maintainer identity.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v8.4.1
2 findingsMaintainer email '[email protected]' uses domain 'sirmuel.design' which has no DNS records. An attacker could register this domain to hijack the maintainer identity.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v8.4.0
2 findingsMaintainer email '[email protected]' uses domain 'sirmuel.design' which has no DNS records. An attacker could register this domain to hijack the maintainer identity.
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v8.3.0
2 findingsMaintainer email '[email protected]' uses domain 'sirmuel.design' which has no DNS records. An attacker could register this domain to hijack the maintainer identity.
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v8.2.8
2 findingsMaintainer email '[email protected]' uses domain 'sirmuel.design' which has no DNS records. An attacker could register this domain to hijack the maintainer identity.
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v8.2.7
2 findingsMaintainer email '[email protected]' uses domain 'sirmuel.design' which has no DNS records. An attacker could register this domain to hijack the maintainer identity.
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v8.2.5
2 findingsMaintainer email '[email protected]' uses domain 'sirmuel.design' which has no DNS records. An attacker could register this domain to hijack the maintainer identity.
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v8.2.4
2 findingsMaintainer email '[email protected]' uses domain 'sirmuel.design' which has no DNS records. An attacker could register this domain to hijack the maintainer identity.
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v8.2.3
2 findingsMaintainer email '[email protected]' uses domain 'sirmuel.design' which has no DNS records. An attacker could register this domain to hijack the maintainer identity.
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.