formidable
A node.js module for parsing form data, especially file uploads.
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| npm-metadata | no-description | AI (npm-metadata): Old minimal manifest; established high-trust package. | ai | |
| phantom-deps | phantom-dep:gently | AI (phantom-deps): gently referenced in config/tests; benign for this package. | ai | |
| provenance | missing-githead | AI (provenance): Formidable is a mature, high-download package; missing gitHead reflects a publish-environment change, not a supply-chain attack. | ai | |
| semgrep | semgrep:dynamic-require | AI (semgrep): Plugin loader constrained to __dirname/plugins subdirectory; standard pattern for formidable's plugin architecture. | ai | |
| provenance | no-provenance | AI (provenance): Published in 2021 before npm provenance/Sigstore was available; expected for this era. | ai | |
| maintainer-change | maintainer-added | AI (maintainer-change): New maintainers (chalker, kornel, olstenlarck, tim-smart) reflect the documented 2018 community takeover of formidable, not a compromise. Package metadata and code are clean. | ai | |
| provenance | publisher-changed | AI (provenance): The svnlto → kornel transition in 2018 was a legitimate, publicly documented community maintainer handoff for formidable. No malicious indicators present. | ai | |
| bogus-package | bogus-package | AI (bogus-package): Sparse legacy manifest on a 22.7M-download canonical package; not spam. | ai | |
| semgrep | semgrep:base64-decode | AI (semgrep): Base64 decoding is essential for multipart form parsing with Content-Transfer-Encoding: base64. | ai |
Versions (showing 50 of 50)
| Version | Deps | Published |
|---|---|---|
| 3.5.4 | 3 / 18 | |
| 3.5.3 | 3 / 24 | |
| 2.1.5 | 4 / 15 | |
| 2.1.4 | 4 / 15 | |
| 2.1.3 | 4 / 17 | |
| 2.0.1 | 4 / 20 | |
| 2.0.0 | 4 / 20 | |
| 1.2.6 | 0 / 6 | |
| 1.2.5 | 0 / 6 | |
| 1.2.4 | 0 / 6 | |
| 1.2.3 | 0 / 6 | |
| 1.2.2 | 0 / 6 | |
| 1.2.1 | 0 / 6 | |
| 1.2.0 | 0 / 6 | |
| 1.1.1 | 0 / 6 | |
| 1.0.17 | 0 / 6 | |
| 1.0.16 | 0 / 6 | |
| 1.0.15 | 0 / 6 | |
| 1.0.14 | 0 / 6 | |
| 1.0.13 | 0 / 6 | |
| 1.0.12 | 0 / 6 | |
| 1.0.11 | 0 / 5 | |
| 1.0.10 | 0 / 5 | |
| 1.0.9 | 0 / 5 | |
| 1.0.8 | 0 / 5 | |
| 1.0.7 | 0 / 5 | |
| 1.0.6 | 0 / 5 | |
| 1.0.5 | 0 / 5 | |
| 1.0.4 | 0 / 5 | |
| 1.0.3 | 0 / 5 | |
| 1.0.2 | 0 / 1 | |
| 1.0.1 | 1 / 0 | |
| 1.0.0 | 1 / 0 | |
| 0.9.11 | 1 / 0 | |
| 0.9.10 | 1 / 0 | |
| 0.9.9 | 1 / 0 | |
| 0.9.8 | 1 / 0 | |
| 0.9.7 | 1 / 0 | |
| 0.9.6 | 1 / 0 | |
| 0.9.4 | 1 / 0 | |
| 0.9.3 | 1 / 0 | |
| 0.9.2 | 1 / 0 | |
| 0.9.1 | 1 / 0 | |
| 0.9.0 | 1 / 0 | |
| 0.8.0 | 1 / 0 | |
| 0.7.0 | 1 / 0 | |
| 0.6.0 | 1 / 0 | |
| 0.5.0 | 1 / 0 | |
| 0.4.0 | 1 / 0 | |
| 0.3.0 | 1 / 0 |
v1.0.11
2 findings[Reject — re-review on republish] (prior reject: AI (bogus-package): Empty entry point at a randomly-generated path, no metadata, no repo — clear bogus/squatting package indicators that generalize across all versions of this suspicious publisher's r) Matched 4 signal(s), weighted score 4: • [S_DESC_MATCHES_NAME] Description is empty or just restates the package name. • [S_NO_REPO_NO_HOME] No repository, homepage, or bugs URL — genuine packages almost always link somewhere. • [S_NO_KEYWORDS] No keywords declared. • [S_EMPTY_MAIN] Entry point (index.js) is 45 bytes — effectively empty.
[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.10
2 findings[Reject — re-review on republish] (prior reject: AI (bogus-package): Empty entry point at a randomly-generated path, no metadata, no repo — clear bogus/squatting package indicators that generalize across all versions of this suspicious publisher's r) Matched 4 signal(s), weighted score 4: • [S_DESC_MATCHES_NAME] Description is empty or just restates the package name. • [S_NO_REPO_NO_HOME] No repository, homepage, or bugs URL — genuine packages almost always link somewhere. • [S_NO_KEYWORDS] No keywords declared. • [S_EMPTY_MAIN] Entry point (index.js) is 45 bytes — effectively empty.
[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.9
2 findings[Reject — re-review on republish] (prior reject: AI (bogus-package): Empty entry point at a randomly-generated path, no metadata, no repo — clear bogus/squatting package indicators that generalize across all versions of this suspicious publisher's r) Matched 4 signal(s), weighted score 4: • [S_DESC_MATCHES_NAME] Description is empty or just restates the package name. • [S_NO_REPO_NO_HOME] No repository, homepage, or bugs URL — genuine packages almost always link somewhere. • [S_NO_KEYWORDS] No keywords declared. • [S_EMPTY_MAIN] Entry point (index.js) is 45 bytes — effectively empty.
[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.8
2 findings[Reject — re-review on republish] (prior reject: AI (bogus-package): Empty entry point at a randomly-generated path, no metadata, no repo — clear bogus/squatting package indicators that generalize across all versions of this suspicious publisher's r) Matched 4 signal(s), weighted score 4: • [S_DESC_MATCHES_NAME] Description is empty or just restates the package name. • [S_NO_REPO_NO_HOME] No repository, homepage, or bugs URL — genuine packages almost always link somewhere. • [S_NO_KEYWORDS] No keywords declared. • [S_EMPTY_MAIN] Entry point (index.js) is 45 bytes — effectively empty.
[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.7
2 findings[Reject — re-review on republish] (prior reject: AI (bogus-package): Empty entry point at a randomly-generated path, no metadata, no repo — clear bogus/squatting package indicators that generalize across all versions of this suspicious publisher's r) Matched 4 signal(s), weighted score 4: • [S_DESC_MATCHES_NAME] Description is empty or just restates the package name. • [S_NO_REPO_NO_HOME] No repository, homepage, or bugs URL — genuine packages almost always link somewhere. • [S_NO_KEYWORDS] No keywords declared. • [S_EMPTY_MAIN] Entry point (index.js) is 45 bytes — effectively empty.
[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.6
2 findings[Reject — re-review on republish] (prior reject: AI (bogus-package): Empty entry point at a randomly-generated path, no metadata, no repo — clear bogus/squatting package indicators that generalize across all versions of this suspicious publisher's r) Matched 4 signal(s), weighted score 4: • [S_DESC_MATCHES_NAME] Description is empty or just restates the package name. • [S_NO_REPO_NO_HOME] No repository, homepage, or bugs URL — genuine packages almost always link somewhere. • [S_NO_KEYWORDS] No keywords declared. • [S_EMPTY_MAIN] Entry point (index.js) is 45 bytes — effectively empty.
[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.5
2 findings[Reject — re-review on republish] (prior reject: AI (bogus-package): Empty entry point at a randomly-generated path, no metadata, no repo — clear bogus/squatting package indicators that generalize across all versions of this suspicious publisher's r) Matched 4 signal(s), weighted score 4: • [S_DESC_MATCHES_NAME] Description is empty or just restates the package name. • [S_NO_REPO_NO_HOME] No repository, homepage, or bugs URL — genuine packages almost always link somewhere. • [S_NO_KEYWORDS] No keywords declared. • [S_EMPTY_MAIN] Entry point (index.js) is 45 bytes — effectively empty.
[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.4
2 findings[Reject — re-review on republish] (prior reject: AI (bogus-package): Empty entry point at a randomly-generated path, no metadata, no repo — clear bogus/squatting package indicators that generalize across all versions of this suspicious publisher's r) Matched 4 signal(s), weighted score 4: • [S_DESC_MATCHES_NAME] Description is empty or just restates the package name. • [S_NO_REPO_NO_HOME] No repository, homepage, or bugs URL — genuine packages almost always link somewhere. • [S_NO_KEYWORDS] No keywords declared. • [S_EMPTY_MAIN] Entry point (index.js) is 45 bytes — effectively empty.
[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.3
2 findings[Reject — re-review on republish] (prior reject: AI (bogus-package): Empty entry point at a randomly-generated path, no metadata, no repo — clear bogus/squatting package indicators that generalize across all versions of this suspicious publisher's r) Matched 4 signal(s), weighted score 4: • [S_DESC_MATCHES_NAME] Description is empty or just restates the package name. • [S_NO_REPO_NO_HOME] No repository, homepage, or bugs URL — genuine packages almost always link somewhere. • [S_NO_KEYWORDS] No keywords declared. • [S_EMPTY_MAIN] Entry point (index.js) is 45 bytes — effectively empty.
[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.2
2 findings[Reject — re-review on republish] (prior reject: AI (bogus-package): Empty entry point at a randomly-generated path, no metadata, no repo — clear bogus/squatting package indicators that generalize across all versions of this suspicious publisher's r) Matched 4 signal(s), weighted score 4: • [S_DESC_MATCHES_NAME] Description is empty or just restates the package name. • [S_NO_REPO_NO_HOME] No repository, homepage, or bugs URL — genuine packages almost always link somewhere. • [S_NO_KEYWORDS] No keywords declared. • [S_EMPTY_MAIN] Entry point (index.js) is 45 bytes — effectively empty.
[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.1
2 findings[Reject — re-review on republish] (prior reject: AI (bogus-package): Empty entry point at a randomly-generated path, no metadata, no repo — clear bogus/squatting package indicators that generalize across all versions of this suspicious publisher's r) Matched 4 signal(s), weighted score 4: • [S_DESC_MATCHES_NAME] Description is empty or just restates the package name. • [S_NO_REPO_NO_HOME] No repository, homepage, or bugs URL — genuine packages almost always link somewhere. • [S_NO_KEYWORDS] No keywords declared. • [S_EMPTY_MAIN] Entry point (index.js) is 45 bytes — effectively empty.
[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.0
2 findings[Reject — re-review on republish] (prior reject: AI (bogus-package): Empty entry point at a randomly-generated path, no metadata, no repo — clear bogus/squatting package indicators that generalize across all versions of this suspicious publisher's r) Matched 4 signal(s), weighted score 4: • [S_DESC_MATCHES_NAME] Description is empty or just restates the package name. • [S_NO_REPO_NO_HOME] No repository, homepage, or bugs URL — genuine packages almost always link somewhere. • [S_NO_KEYWORDS] No keywords declared. • [S_EMPTY_MAIN] Entry point (index.js) is 45 bytes — effectively empty.
[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.9.11
2 findings[Reject — re-review on republish] (prior reject: AI (bogus-package): Empty entry point at a randomly-generated path, no metadata, no repo — clear bogus/squatting package indicators that generalize across all versions of this suspicious publisher's r) Matched 4 signal(s), weighted score 4: • [S_DESC_MATCHES_NAME] Description is empty or just restates the package name. • [S_NO_REPO_NO_HOME] No repository, homepage, or bugs URL — genuine packages almost always link somewhere. • [S_NO_KEYWORDS] No keywords declared. • [S_EMPTY_MAIN] Entry point (index.js) is 45 bytes — effectively empty.
[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.9.10
2 findings[Reject — re-review on republish] (prior reject: AI (bogus-package): Empty entry point at a randomly-generated path, no metadata, no repo — clear bogus/squatting package indicators that generalize across all versions of this suspicious publisher's r) Matched 4 signal(s), weighted score 4: • [S_DESC_MATCHES_NAME] Description is empty or just restates the package name. • [S_NO_REPO_NO_HOME] No repository, homepage, or bugs URL — genuine packages almost always link somewhere. • [S_NO_KEYWORDS] No keywords declared. • [S_EMPTY_MAIN] Entry point (index.js) is 45 bytes — effectively empty.
[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.9.9
2 findings[Reject — re-review on republish] (prior reject: AI (bogus-package): Empty entry point at a randomly-generated path, no metadata, no repo — clear bogus/squatting package indicators that generalize across all versions of this suspicious publisher's r) Matched 4 signal(s), weighted score 4: • [S_DESC_MATCHES_NAME] Description is empty or just restates the package name. • [S_NO_REPO_NO_HOME] No repository, homepage, or bugs URL — genuine packages almost always link somewhere. • [S_NO_KEYWORDS] No keywords declared. • [S_EMPTY_MAIN] Entry point (1289345074301-0.6417043334804475/index.js) is 45 bytes — effectively empty.
[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.9.8
2 findings[Reject — re-review on republish] (prior reject: AI (bogus-package): Empty entry point at a randomly-generated path, no metadata, no repo — clear bogus/squatting package indicators that generalize across all versions of this suspicious publisher's r) Matched 4 signal(s), weighted score 4: • [S_DESC_MATCHES_NAME] Description is empty or just restates the package name. • [S_NO_REPO_NO_HOME] No repository, homepage, or bugs URL — genuine packages almost always link somewhere. • [S_NO_KEYWORDS] No keywords declared. • [S_EMPTY_MAIN] Entry point (1289345073942-0.6435386468656361/index.js) is 45 bytes — effectively empty.
[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.9.7
2 findings[Reject — re-review on republish] (prior reject: AI (bogus-package): Empty entry point at a randomly-generated path, no metadata, no repo — clear bogus/squatting package indicators that generalize across all versions of this suspicious publisher's r) Matched 4 signal(s), weighted score 4: • [S_DESC_MATCHES_NAME] Description is empty or just restates the package name. • [S_NO_REPO_NO_HOME] No repository, homepage, or bugs URL — genuine packages almost always link somewhere. • [S_NO_KEYWORDS] No keywords declared. • [S_EMPTY_MAIN] Entry point (1289345073218-0.1264446957502514/index.js) is 45 bytes — effectively empty.
[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.9.6
2 findings[Reject — re-review on republish] (prior reject: AI (bogus-package): Empty entry point at a randomly-generated path, no metadata, no repo — clear bogus/squatting package indicators that generalize across all versions of this suspicious publisher's r) Matched 4 signal(s), weighted score 4: • [S_DESC_MATCHES_NAME] Description is empty or just restates the package name. • [S_NO_REPO_NO_HOME] No repository, homepage, or bugs URL — genuine packages almost always link somewhere. • [S_NO_KEYWORDS] No keywords declared. • [S_EMPTY_MAIN] Entry point (1289345072797-0.7291123853065073/index.js) is 45 bytes — effectively empty.
[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.9.4
2 findings[Reject — re-review on republish] (prior reject: AI (bogus-package): Empty entry point at a randomly-generated path, no metadata, no repo — clear bogus/squatting package indicators that generalize across all versions of this suspicious publisher's r) Matched 4 signal(s), weighted score 4: • [S_DESC_MATCHES_NAME] Description is empty or just restates the package name. • [S_NO_REPO_NO_HOME] No repository, homepage, or bugs URL — genuine packages almost always link somewhere. • [S_NO_KEYWORDS] No keywords declared. • [S_EMPTY_MAIN] Entry point (1289345071830-0.2432720735669136/index.js) is 45 bytes — effectively empty.
[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.9.3
2 findings[Reject — re-review on republish] (prior reject: AI (bogus-package): Empty entry point at a randomly-generated path, no metadata, no repo — clear bogus/squatting package indicators that generalize across all versions of this suspicious publisher's r) Matched 4 signal(s), weighted score 4: • [S_DESC_MATCHES_NAME] Description is empty or just restates the package name. • [S_NO_REPO_NO_HOME] No repository, homepage, or bugs URL — genuine packages almost always link somewhere. • [S_NO_KEYWORDS] No keywords declared. • [S_EMPTY_MAIN] Entry point (1289345071444-0.20610092277638614/index.js) is 45 bytes — effectively empty.
[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.9.2
2 findings[Reject — re-review on republish] (prior reject: AI (bogus-package): Empty entry point at a randomly-generated path, no metadata, no repo — clear bogus/squatting package indicators that generalize across all versions of this suspicious publisher's r) Matched 4 signal(s), weighted score 4: • [S_DESC_MATCHES_NAME] Description is empty or just restates the package name. • [S_NO_REPO_NO_HOME] No repository, homepage, or bugs URL — genuine packages almost always link somewhere. • [S_NO_KEYWORDS] No keywords declared. • [S_EMPTY_MAIN] Entry point (1289345070892-0.44422834273427725/index.js) is 45 bytes — effectively empty.
[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.9.1
2 findings[Reject — re-review on republish] (prior reject: AI (bogus-package): Empty entry point at a randomly-generated path, no metadata, no repo — clear bogus/squatting package indicators that generalize across all versions of this suspicious publisher's r) Matched 4 signal(s), weighted score 4: • [S_DESC_MATCHES_NAME] Description is empty or just restates the package name. • [S_NO_REPO_NO_HOME] No repository, homepage, or bugs URL — genuine packages almost always link somewhere. • [S_NO_KEYWORDS] No keywords declared. • [S_EMPTY_MAIN] Entry point (1289345070556-0.05554284271784127/index.js) is 45 bytes — effectively empty.
[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.9.0
2 findings[Reject — re-review on republish] (prior reject: AI (bogus-package): Empty entry point at a randomly-generated path, no metadata, no repo — clear bogus/squatting package indicators that generalize across all versions of this suspicious publisher's r) Matched 4 signal(s), weighted score 4: • [S_DESC_MATCHES_NAME] Description is empty or just restates the package name. • [S_NO_REPO_NO_HOME] No repository, homepage, or bugs URL — genuine packages almost always link somewhere. • [S_NO_KEYWORDS] No keywords declared. • [S_EMPTY_MAIN] Entry point (1289345070224-0.555212922161445/index.js) is 45 bytes — effectively empty.
[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.8.0
2 findings[Reject — re-review on republish] (prior reject: AI (bogus-package): Empty entry point at a randomly-generated path, no metadata, no repo — clear bogus/squatting package indicators that generalize across all versions of this suspicious publisher's r) Matched 4 signal(s), weighted score 4: • [S_DESC_MATCHES_NAME] Description is empty or just restates the package name. • [S_NO_REPO_NO_HOME] No repository, homepage, or bugs URL — genuine packages almost always link somewhere. • [S_NO_KEYWORDS] No keywords declared. • [S_EMPTY_MAIN] Entry point (1289345069649-0.6692214487120509/index.js) is 45 bytes — effectively empty.
[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.7.0
2 findings[Reject — re-review on republish] (prior reject: AI (bogus-package): Empty entry point at a randomly-generated path, no metadata, no repo — clear bogus/squatting package indicators that generalize across all versions of this suspicious publisher's r) Matched 4 signal(s), weighted score 4: • [S_DESC_MATCHES_NAME] Description is empty or just restates the package name. • [S_NO_REPO_NO_HOME] No repository, homepage, or bugs URL — genuine packages almost always link somewhere. • [S_NO_KEYWORDS] No keywords declared. • [S_EMPTY_MAIN] Entry point (1289345069244-0.12069786246865988/index.js) is 45 bytes — effectively empty.
[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.6.0
2 findings[Reject — re-review on republish] (prior reject: AI (bogus-package): Empty entry point at a randomly-generated path, no metadata, no repo — clear bogus/squatting package indicators that generalize across all versions of this suspicious publisher's r) Matched 4 signal(s), weighted score 4: • [S_DESC_MATCHES_NAME] Description is empty or just restates the package name. • [S_NO_REPO_NO_HOME] No repository, homepage, or bugs URL — genuine packages almost always link somewhere. • [S_NO_KEYWORDS] No keywords declared. • [S_EMPTY_MAIN] Entry point (1289345068908-0.3251923874486238/index.js) is 45 bytes — effectively empty.
[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.5.0
2 findings[Reject — re-review on republish] (prior reject: AI (bogus-package): Empty entry point at a randomly-generated path, no metadata, no repo — clear bogus/squatting package indicators that generalize across all versions of this suspicious publisher's r) Matched 4 signal(s), weighted score 4: • [S_DESC_MATCHES_NAME] Description is empty or just restates the package name. • [S_NO_REPO_NO_HOME] No repository, homepage, or bugs URL — genuine packages almost always link somewhere. • [S_NO_KEYWORDS] No keywords declared. • [S_EMPTY_MAIN] Entry point (1289345068340-0.914619353832677/index.js) is 45 bytes — effectively empty.
[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.4.0
2 findings[Reject — re-review on republish] (prior reject: AI (bogus-package): Empty entry point at a randomly-generated path, no metadata, no repo — clear bogus/squatting package indicators that generalize across all versions of this suspicious publisher's r) Matched 4 signal(s), weighted score 4: • [S_DESC_MATCHES_NAME] Description is empty or just restates the package name. • [S_NO_REPO_NO_HOME] No repository, homepage, or bugs URL — genuine packages almost always link somewhere. • [S_NO_KEYWORDS] No keywords declared. • [S_EMPTY_MAIN] Entry point (1289345067997-0.9282957585528493/index.js) is 45 bytes — effectively empty.
[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.3.0
2 findings[Reject — re-review on republish] (prior reject: AI (bogus-package): Empty entry point at a randomly-generated path, no metadata, no repo — clear bogus/squatting package indicators that generalize across all versions of this suspicious publisher's r) Matched 4 signal(s), weighted score 4: • [S_DESC_MATCHES_NAME] Description is empty or just restates the package name. • [S_NO_REPO_NO_HOME] No repository, homepage, or bugs URL — genuine packages almost always link somewhere. • [S_NO_KEYWORDS] No keywords declared. • [S_EMPTY_MAIN] Entry point (1289345067601-0.7006325819529593/index.js) is 45 bytes — effectively empty.
[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.