assistant-stream MIT 15 versions

assistant-stream

npm Repository Homepage

Streaming utilities for AI assistants

15

Versions

MIT

License

No

Install Scripts

Verified

Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures No source commit

Maintainers

yonomagentbase-bot

Keywords

aistreamingassistantchatopenaillmassistant-ui

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
source-diff	large-new-source-files	AI (source-diff): Package ships src/; file-count growth is normal build output, no injected payload.	ai	2026/07/08
npm-metadata	suspicious-initial-version	AI (npm-metadata): 0.0.0 is a placeholder for this long-lived package, not a throwaway.	ai	2026/07/08
publish-pattern	dormant-publish	AI (publish-pattern): SLSA provenance attestation via Sigstore confirms legitimate CI/CD publish, substantially mitigating account-takeover risk from dormancy.	ai	2026/04/26
publish-pattern	new-deps-added	AI (publish-pattern): @standard-schema/spec is a well-known, legitimate schema specification package; not a suspicious dependency for this type of library.	ai	2026/04/26
bogus-package	bogus-package	AI (bogus-package): High-download, ecosystem-trusted package; sparse metadata on the 0.0.0 placeholder is benign.	ai	2026/04/26

Versions (showing 15 of 115)

Version	Deps	Published
0.0.15	2 / 6	2025-01-08
0.0.14	2 / 6	2025-01-05
0.0.13	2 / 6	2024-12-23
0.0.12	2 / 6	2024-12-16
0.0.11	2 / 6	2024-12-15
0.0.10	2 / 6	2024-12-12
0.0.9	2 / 6	2024-12-12
0.0.8	2 / 6	2024-11-24
0.0.7	2 / 6	2024-11-20
0.0.6	2 / 6	2024-11-19
0.0.5	2 / 6	2024-10-28
0.0.4	2 / 6	2024-10-27
0.0.3	2 / 6	2024-10-25
0.0.2	2 / 6	2024-10-21
0.0.0	0 / 0	2024-09-29

v0.0.15

2 findings

HIGH Low-value / spam package indicators (3 signals, score 4) bogus-package

[Reject — re-review on republish] (prior reject: AI (bogus-package): Multiple spam indicators (no README code, empty description, no keywords) suggest low-value package; verdict generalizes across versions.) Matched 3 signal(s), weighted score 4: • [S_README_NO_CODE] Short README with no code block, no install instructions, and no usage/API section. • [S_DESC_MATCHES_NAME] Description is empty or just restates the package name. • [S_NO_KEYWORDS] No keywords declared.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.14

2 findings

HIGH Low-value / spam package indicators (3 signals, score 4) bogus-package

[Reject — re-review on republish] (prior reject: AI (bogus-package): Multiple spam indicators (no README code, empty description, no keywords) suggest low-value package; verdict generalizes across versions.) Matched 3 signal(s), weighted score 4: • [S_README_NO_CODE] Short README with no code block, no install instructions, and no usage/API section. • [S_DESC_MATCHES_NAME] Description is empty or just restates the package name. • [S_NO_KEYWORDS] No keywords declared.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.13

2 findings

HIGH Low-value / spam package indicators (3 signals, score 4) bogus-package

[Reject — re-review on republish] (prior reject: AI (bogus-package): Multiple spam indicators (no README code, empty description, no keywords) suggest low-value package; verdict generalizes across versions.) Matched 3 signal(s), weighted score 4: • [S_README_NO_CODE] Short README with no code block, no install instructions, and no usage/API section. • [S_DESC_MATCHES_NAME] Description is empty or just restates the package name. • [S_NO_KEYWORDS] No keywords declared.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.12

2 findings

HIGH Low-value / spam package indicators (3 signals, score 4) bogus-package

[Reject — re-review on republish] (prior reject: AI (bogus-package): Multiple spam indicators (no README code, empty description, no keywords) suggest low-value package; verdict generalizes across versions.) Matched 3 signal(s), weighted score 4: • [S_README_NO_CODE] Short README with no code block, no install instructions, and no usage/API section. • [S_DESC_MATCHES_NAME] Description is empty or just restates the package name. • [S_NO_KEYWORDS] No keywords declared.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.11

2 findings

HIGH Low-value / spam package indicators (3 signals, score 4) bogus-package

[Reject — re-review on republish] (prior reject: AI (bogus-package): Multiple spam indicators (no README code, empty description, no keywords) suggest low-value package; verdict generalizes across versions.) Matched 3 signal(s), weighted score 4: • [S_README_NO_CODE] Short README with no code block, no install instructions, and no usage/API section. • [S_DESC_MATCHES_NAME] Description is empty or just restates the package name. • [S_NO_KEYWORDS] No keywords declared.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.10

2 findings

HIGH Low-value / spam package indicators (3 signals, score 4) bogus-package

[Reject — re-review on republish] (prior reject: AI (bogus-package): Multiple spam indicators (no README code, empty description, no keywords) suggest low-value package; verdict generalizes across versions.) Matched 3 signal(s), weighted score 4: • [S_README_NO_CODE] Short README with no code block, no install instructions, and no usage/API section. • [S_DESC_MATCHES_NAME] Description is empty or just restates the package name. • [S_NO_KEYWORDS] No keywords declared.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.9

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.8

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.7

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.6

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.5

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.4

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.0.0

2 findings

HIGH Low-value / spam package indicators (5 signals, score 5) bogus-package

[Reject — re-review on republish] (prior reject: AI (bogus-package): Multiple spam indicators (no README code, empty description, no keywords) suggest low-value package; verdict generalizes across versions.) Matched 5 signal(s), weighted score 5: • [S_DESC_MATCHES_NAME] Description is empty or just restates the package name. • [S_NO_REPO_NO_HOME] No repository, homepage, or bugs URL — genuine packages almost always link somewhere. • [S_NO_KEYWORDS] No keywords declared. • [S_NO_DEPS] No runtime, dev, peer, or optional dependencies declared. • [S_TINY_PAYLOAD] Tiny payload: 0 code file(s), 1174 bytes total.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.