bpmn-js-properties-panel
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| provenance | publisher-changed | AI (provenance): Legitimate maintainer transition within trusted bpmn-io org; no behavioral change in diff. | ai | |
| maintainer-change | maintainer-added | AI (maintainer-change): Same org handoff, consistent with publisher-changed context. | ai | |
| source-diff | encoded-string-file:dist/bpmn-js-properties-panel.umd.js | AI (source-diff): Flagged strings are CodeMirror BiDi lookup tables (LowTypes/ArabicTypes), a stable false positive for this bundled UMD output. | ai | |
| bogus-package | bogus-package | AI (bogus-package): Legitimate bpmn-io project; spam-flagged co-maintainers are incidental, not indicative of malicious content. | ai |
Versions (showing 26 of 26)
| Version | Deps | Published |
|---|---|---|
| 6.0.1 | 5 / 49 | |
| 6.0.0 | 5 / 49 | |
| 5.62.0 | 5 / 48 | |
| 5.61.0 | 5 / 48 | |
| 5.60.0 | 5 / 48 | |
| 5.59.0 | 5 / 48 | |
| 5.58.0 | 5 / 48 | |
| 5.57.0 | 5 / 48 | |
| 5.56.0 | 5 / 48 | |
| 5.55.0 | 5 / 48 | |
| 5.54.0 | 5 / 49 | |
| 5.53.0 | 5 / 49 | |
| 5.52.1 | 5 / 49 | |
| 5.52.0 | 5 / 49 | |
| 5.51.0 | 5 / 49 | |
| 5.50.1 | 5 / 49 | |
| 5.50.0 | 5 / 49 | |
| 5.49.0 | 5 / 49 | |
| 5.48.0 | 5 / 49 | |
| 5.47.0 | 5 / 49 | |
| 5.46.0 | 5 / 49 | |
| 5.45.0 | 5 / 49 | |
| 5.44.0 | 5 / 49 | |
| 5.43.1 | 5 / 49 | |
| 5.43.0 | 5 / 49 | |
| 5.35.0 | 5 / 49 |
v6.0.1
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (jarekdanielak) than the most recent previously approved version (barmac) on 2026-02-17, but jarekdanielak is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v6.0.0
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (barmac) than the most recent previously approved version (jarekdanielak) on 2026-02-05, but barmac is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v5.62.0
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (barmac) than the most recent previously approved version (jarekdanielak) on 2026-07-24, but barmac is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v5.61.0
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (jarekdanielak) than the most recent previously approved version (barmac) on 2026-07-14, but jarekdanielak is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v5.53.0
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (nikku) than the most recent previously approved version (jarekdanielak) on 2026-03-03, but nikku is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v5.52.1
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (jarekdanielak) than the most recent previously approved version (nikku) on 2026-02-24, but jarekdanielak is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v5.52.0
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (barmac) than the most recent previously approved version (nikku) on 2026-02-23, but barmac is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v5.51.0
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (nikku) than the most recent previously approved version (jarekdanielak) on 2026-02-18, but nikku is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v5.50.1
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (jarekdanielak) than the most recent previously approved version (nikku) on 2026-02-05, but jarekdanielak is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v5.50.0
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (nikku) than the most recent previously approved version (jarekdanielak) on 2026-02-04, but nikku is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v5.49.0
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (jarekdanielak) than the most recent previously approved version (barmac) on 2026-02-03, but jarekdanielak is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v5.48.0
2 findingsThis version was published by a different npm account than previous versions on 2026-01-22. This could indicate a legitimate maintainer transition or an account compromise.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.47.0
2 findingsThis version was published by a different npm account than previous versions on 2026-01-21. This could indicate a legitimate maintainer transition or an account compromise.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.46.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.45.0
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (barmac) than the most recent previously approved version (jarekdanielak) on 2025-12-18, but barmac is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v5.44.0
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (jarekdanielak) than the most recent previously approved version (barmac) on 2025-12-03, but jarekdanielak is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v5.43.1
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (philippfromme) than the most recent previously approved version (barmac) on 2025-12-01, but philippfromme is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v5.43.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.