altair-graphql-core
Several of the core logic for altair graphql client
Supply chain provenance
Status for the latest visible version.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| email-domain | unclaimed-email:sirmuel.design | AI (email-domain): Author's personal domain used consistently across 188 versions; no evidence of hijack or impersonation. | ai | |
| publish-pattern | rapid-publish | AI (publish-pattern): Automated CI/CD publishing via GitHub Actions; rapid successive publishes are expected for this package. | ai | |
| semgrep | semgrep:child-process-import | AI (semgrep): child_process used only in build script (scripts/build.js), not in runtime package code. | ai | |
| phantom-deps | phantom-dep:apollo-link | AI (phantom-deps): apollo-link is a declared runtime dep used transitively; phantom-dep heuristic is a false positive here. | ai | |
| phantom-deps | phantom-dep:apollo-link-http | AI (phantom-deps): apollo-link-http is a declared runtime dep; phantom-dep heuristic is a false positive here. | ai | |
| phantom-deps | phantom-dep:apollo-cache-inmemory | AI (phantom-deps): apollo-cache-inmemory is a declared runtime dep; phantom-dep heuristic is a false positive here. | ai |
Versions (showing 19 of 19)
| Version | Deps | Published |
|---|---|---|
| 8.5.7 | 27 / 28 | |
| 8.5.6 | 27 / 28 | |
| 8.5.5 | 27 / 28 | |
| 8.5.4 | 27 / 28 | |
| 8.5.3 | 27 / 28 | |
| 8.5.2 | 27 / 27 | |
| 8.5.1 | 27 / 27 | |
| 8.5.0 | 27 / 27 | |
| 8.4.4 | 26 / 31 | |
| 8.4.3 | 26 / 31 | |
| 8.4.2 | 26 / 31 | |
| 8.4.1 | 26 / 31 | |
| 8.4.0 | 26 / 31 | |
| 8.3.0 | 26 / 30 | |
| 8.2.8 | 26 / 30 | |
| 8.2.7 | 26 / 30 | |
| 8.2.5 | 25 / 29 | |
| 8.2.4 | 25 / 29 | |
| 8.2.3 | 25 / 29 |
v8.5.7
2 findingsMaintainer email '[email protected]' uses domain 'sirmuel.design' which has no DNS records. An attacker could register this domain to hijack the maintainer identity.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v8.5.6
2 findingsMaintainer email '[email protected]' uses domain 'sirmuel.design' which has no DNS records. An attacker could register this domain to hijack the maintainer identity.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v8.5.5
2 findingsMaintainer email '[email protected]' uses domain 'sirmuel.design' which has no DNS records. An attacker could register this domain to hijack the maintainer identity.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v8.5.4
2 findingsMaintainer email '[email protected]' uses domain 'sirmuel.design' which has no DNS records. An attacker could register this domain to hijack the maintainer identity.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v8.5.3
2 findingsMaintainer email '[email protected]' uses domain 'sirmuel.design' which has no DNS records. An attacker could register this domain to hijack the maintainer identity.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v8.5.1
2 findingsMaintainer email '[email protected]' uses domain 'sirmuel.design' which has no DNS records. An attacker could register this domain to hijack the maintainer identity.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v8.5.0
2 findingsMaintainer email '[email protected]' uses domain 'sirmuel.design' which has no DNS records. An attacker could register this domain to hijack the maintainer identity.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v8.4.4
2 findingsMaintainer email '[email protected]' uses domain 'sirmuel.design' which has no DNS records. An attacker could register this domain to hijack the maintainer identity.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v8.4.3
2 findingsMaintainer email '[email protected]' uses domain 'sirmuel.design' which has no DNS records. An attacker could register this domain to hijack the maintainer identity.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v8.4.2
2 findingsMaintainer email '[email protected]' uses domain 'sirmuel.design' which has no DNS records. An attacker could register this domain to hijack the maintainer identity.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v8.4.1
2 findingsMaintainer email '[email protected]' uses domain 'sirmuel.design' which has no DNS records. An attacker could register this domain to hijack the maintainer identity.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v8.4.0
2 findingsMaintainer email '[email protected]' uses domain 'sirmuel.design' which has no DNS records. An attacker could register this domain to hijack the maintainer identity.
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v8.3.0
2 findingsMaintainer email '[email protected]' uses domain 'sirmuel.design' which has no DNS records. An attacker could register this domain to hijack the maintainer identity.
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v8.2.8
2 findingsMaintainer email '[email protected]' uses domain 'sirmuel.design' which has no DNS records. An attacker could register this domain to hijack the maintainer identity.
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v8.2.7
2 findingsMaintainer email '[email protected]' uses domain 'sirmuel.design' which has no DNS records. An attacker could register this domain to hijack the maintainer identity.
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v8.2.5
2 findingsMaintainer email '[email protected]' uses domain 'sirmuel.design' which has no DNS records. An attacker could register this domain to hijack the maintainer identity.
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v8.2.4
2 findingsMaintainer email '[email protected]' uses domain 'sirmuel.design' which has no DNS records. An attacker could register this domain to hijack the maintainer identity.
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v8.2.3
2 findingsMaintainer email '[email protected]' uses domain 'sirmuel.design' which has no DNS records. An attacker could register this domain to hijack the maintainer identity.
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.