hermes-eslint
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| maintainer-change | maintainer-added | AI (maintainer-change): Long-stable transfer from 2021, part of official flowtype/facebook org. | ai | |
| maintainer-change | maintainer-removed | AI (maintainer-change): Same 2021 transfer, no recent takeover signal. | ai | |
| provenance | publisher-changed-stale | AI (provenance): Stale historical change, 1950 days unremoved, not a takeover indicator. | ai |
Versions (showing 51 of 62)
| Version | Deps | Published |
|---|---|---|
| 0.37.0 | 2 / 1 | |
| 0.36.1 | 3 / 0 | |
| 0.36.0 | 3 / 0 | |
| 0.35.0 | 3 / 0 | |
| 0.34.0 | 3 / 0 | |
| 0.33.3 | 3 / 0 | |
| 0.33.2 | 3 / 0 | |
| 0.33.1 | 3 / 0 | |
| 0.33.0 | 3 / 0 | |
| 0.32.1 | 3 / 0 | |
| 0.32.0 | 3 / 0 | |
| 0.31.2 | 3 / 0 | |
| 0.31.0 | 3 / 0 | |
| 0.30.0 | 3 / 0 | |
| 0.29.1 | 3 / 0 | |
| 0.29.0 | 3 / 0 | |
| 0.28.1 | 3 / 0 | |
| 0.28.0 | 3 / 0 | |
| 0.27.0 | 3 / 0 | |
| 0.26.0 | 3 / 0 | |
| 0.25.1 | 3 / 0 | |
| 0.25.0 | 3 / 0 | |
| 0.24.0 | 3 / 0 | |
| 0.23.1 | 3 / 0 | |
| 0.23.0 | 3 / 0 | |
| 0.22.0 | 3 / 0 | |
| 0.21.1 | 3 / 0 | |
| 0.21.0 | 3 / 0 | |
| 0.20.1 | 3 / 0 | |
| 0.20.0 | 3 / 0 | |
| 0.19.2 | 3 / 0 | |
| 0.19.1 | 3 / 0 | |
| 0.19.0 | 3 / 0 | |
| 0.18.2 | 3 / 0 | |
| 0.18.1 | 3 / 0 | |
| 0.18.0 | 3 / 0 | |
| 0.17.1 | 3 / 0 | |
| 0.17.0 | 3 / 0 | |
| 0.16.0 | 3 / 0 | |
| 0.15.1 | 3 / 0 | |
| 0.15.0 | 3 / 0 | |
| 0.14.0 | 3 / 0 | |
| 0.13.1 | 3 / 0 | |
| 0.13.0 | 3 / 0 | |
| 0.12.1 | 3 / 0 | |
| 0.12.0 | 3 / 0 | |
| 0.11.1 | 3 / 0 | |
| 0.11.0 | 3 / 0 | |
| 0.10.1 | 3 / 0 | |
| 0.10.0 | 3 / 0 | |
| 0.9.0 | 3 / 0 |
v0.37.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.20.1
2 findingsThis version was published by a different npm account (hermes-team) than the most recent previously approved version (hanshalverson) on 2024-03-04. It has since remained available on npm for 866 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.20.0
2 findingsThis version was published by a different npm account (hermes-team) than the most recent previously approved version (hanshalverson) on 2024-02-28. It has since remained available on npm for 871 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.19.2
2 findingsThis version was published by a different npm account (hermes-team) than the most recent previously approved version (hanshalverson) on 2024-02-22. It has since remained available on npm for 878 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.19.1
2 findingsThis version was published by a different npm account (hermes-team) than the most recent previously approved version (hanshalverson) on 2024-02-06. It has since remained available on npm for 894 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.19.0
2 findingsThis version was published by a different npm account (hermes-team) than the most recent previously approved version (hanshalverson) on 2024-02-01. It has since remained available on npm for 898 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.18.2
2 findingsThis version was published by a different npm account (hermes-team) than the most recent previously approved version (hanshalverson) on 2023-12-19. It has since remained available on npm for 942 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.18.1
2 findingsThis version was published by a different npm account (hermes-team) than the most recent previously approved version (hanshalverson) on 2023-12-15. It has since remained available on npm for 947 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.18.0
2 findingsThis version was published by a different npm account (hermes-team) than the most recent previously approved version (hanshalverson) on 2023-11-28. It has since remained available on npm for 964 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.17.1
2 findingsThis version was published by a different npm account (hermes-team) than the most recent previously approved version (hanshalverson) on 2023-11-02. It has since remained available on npm for 990 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.17.0
2 findingsThis version was published by a different npm account (hermes-team) than the most recent previously approved version (hanshalverson) on 2023-10-18. It has since remained available on npm for 1005 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.16.0
2 findingsThis version was published by a different npm account (hermes-team) than the most recent previously approved version (hanshalverson) on 2023-09-22. It has since remained available on npm for 1030 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.15.1
2 findingsThis version was published by a different npm account (hermes-team) than the most recent previously approved version (hanshalverson) on 2023-08-07. It has since remained available on npm for 1077 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.15.0
2 findingsThis version was published by a different npm account (hermes-team) than the most recent previously approved version (hanshalverson) on 2023-07-25. It has since remained available on npm for 1090 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.14.0
2 findingsThis version was published by a different npm account (hermes-team) than the most recent previously approved version (hanshalverson) on 2023-06-29. It has since remained available on npm for 1116 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.13.1
2 findingsThis version was published by a different npm account (hermes-team) than the most recent previously approved version (hanshalverson) on 2023-06-27. It has since remained available on npm for 1118 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.13.0
2 findingsThis version was published by a different npm account (hermes-team) than the most recent previously approved version (hanshalverson) on 2023-06-26. It has since remained available on npm for 1119 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.12.1
2 findingsThis version was published by a different npm account (hermes-team) than the most recent previously approved version (hanshalverson) on 2023-06-09. It has since remained available on npm for 1135 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.12.0
2 findingsThis version was published by a different npm account (hermes-team) than the most recent previously approved version (hanshalverson) on 2023-05-26. It has since remained available on npm for 1149 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.11.1
2 findingsThis version was published by a different npm account (hermes-team) than the most recent previously approved version (hanshalverson) on 2023-04-28. It has since remained available on npm for 1177 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.11.0
2 findingsThis version was published by a different npm account (hermes-team) than the most recent previously approved version (hanshalverson) on 2023-04-28. It has since remained available on npm for 1178 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.10.1
2 findingsThis version was published by a different npm account (hermes-team) than the most recent previously approved version (hanshalverson) on 2023-03-29. It has since remained available on npm for 1208 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.10.0
2 findingsThis version was published by a different npm account (flowtype) than the most recent previously approved version (hanshalverson) on 2023-03-09. It has since remained available on npm for 1228 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.9.0
2 findingsThis version was published by a different npm account (hermes-team) than the most recent previously approved version (hanshalverson) on 2022-07-15. It has since remained available on npm for 1465 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.