convex

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account (nicolapps) than the most recent previously approved version (reece-convex) on 2026-07-14, but nicolapps is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account (reece-convex) than the most recent previously approved version (nicolapps) on 2026-06-29, but reece-convex is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account (nicolapps) than the most recent previously approved version (aritrakh) on 2026-06-01, but nicolapps is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account (ianatconvex) than the most recent previously approved version (aritrakh) on 2026-05-15, but ianatconvex is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account (nicolapps) than the most recent previously approved version (aritrakh) on 2026-04-30, but nicolapps is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

Spreading entire process.env into an object — may capture all secrets 52 | timeout: 35000, 53 | stdio: ["pipe", "pipe", "pipe"], > 54 | env: { 55 | ...process.env, 56 | FORCE_COLOR: "false",

Spreading entire process.env into an object — may capture all secrets 82 | 83 | beforeEach(() => { > 84 | savedEnv = { ...process.env }; 85 | savedIsTTY = process.stdin.isTTY; 86 | process.env = {};

Spreading entire process.env into an object — may capture all secrets 251 | 252 | beforeEach(() => { > 253 | savedEnv = { ...process.env }; 254 | savedIsTTY = process.stdin.isTTY; 255 | process.env = {};

Spreading entire process.env into an object — may capture all secrets 81 | 82 | beforeEach(() => { > 83 | savedEnv = { ...process.env }; 84 | savedIsTTY = process.stdin.isTTY; 85 | process.env = {};

Spreading entire process.env into an object — may capture all secrets 497 | } = await fetchDeploymentCanonicalUrls(ctx, deployment); 498 | > 499 | const env = { ...process.env }; 500 | env[urlVar] = canonicalCloudUrl; 501 | env[siteVar] = canonicalSiteUrl;

Spreading entire process.env into an object — may capture all secrets 134 | .spawn(args.binaryPath, commandArgs, { 135 | stdio: "ignore", > 136 | env: { 137 | ...process.env, 138 | SENTRY_DSN: SENTRY_DSN,

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

This version was published by a different npm account than previous versions on 2026-03-19. This could indicate a legitimate maintainer transition or an account compromise.

Modified file contains 3 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account (nicolapps) than the most recent previously approved version (reece-convex) on 2026-02-18, but nicolapps is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account (nicolapps) than the most recent previously approved version (ballingt) on 2026-01-22, but nicolapps is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account (nicolapps) than the most recent previously approved version (ballingt) on 2025-12-11, but nicolapps is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

Modified file contains 3 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Modified file contains 3 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Modified file contains 3 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account than previous versions on 2025-09-09. This could indicate a legitimate maintainer transition or an account compromise.

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account (ballingt) than the most recent previously approved version (sshader) on 2024-08-22, but ballingt is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account (sshader) than the most recent previously approved version (ballingt) on 2024-08-21, but sshader is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account (ballingt) than the most recent previously approved version (sshader) on 2024-08-15, but ballingt is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account (sshader) than the most recent previously approved version (ballingt) on 2024-08-07, but sshader is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.