← Home

exa-js

npm Repository Homepage
17
Versions
—
License
No
Install Scripts
Verified
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures gitHead linked

Maintainers

hubertyuanjeffzwangfeel-ix-343hubertexatheishangoswamitoman1997anegoiumarkexajacob-exagabriel-exaexa-jakubmiguelatexaliamhzian-exa

Keywords

exametaphorsearchAILLMsRAGretrievalaugmentedgeneration

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
provenance publisher-changed AI (provenance): Migrated to GitHub Actions CI/CD publishing with SLSA provenance; stable for this package. ai
phantom-deps phantom-dep:dotenv AI (phantom-deps): dotenv is a declared runtime dep used via config; stable false positive. ai
phantom-deps phantom-dep:openai AI (phantom-deps): openai is a declared runtime dep used indirectly; stable false positive. ai

Versions (showing 17 of 17)

Version Deps Published
2.16.3 5 / 10
2.16.0 5 / 10
2.15.1 5 / 10
2.15.0 5 / 10
2.14.0 5 / 10
2.12.1 5 / 10
2.11.0 5 / 10
2.0.11 5 / 8
2.0.10 5 / 8
2.0.9 5 / 8
2.0.8 5 / 8
2.0.7 5 / 8
2.0.6 5 / 8
2.0.5 5 / 8
2.0.3 5 / 8
2.0.2 5 / 8
2.0.0 5 / 8

v2.16.3

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v2.16.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v2.15.1

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.