← Home

impit

npm Repository Homepage
53
Versions
—
License
No
Install Scripts
Verified
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures No source commit

Maintainers

mtrunkatjancurnpetrpatekmnmkngjaroslavhejlekdrobnikjmetalwarrior665fnesvedab4nanjanbucharapify-service-accountjindrich.bar

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
bogus-package bogus-package AI (bogus-package): High-download established package; sparse early manifest triggers spam heuristics, not real. ai
npm-metadata no-description AI (npm-metadata): Empty description on early version of a legitimate popular package. ai
provenance missing-githead AI (provenance): Package has SLSA provenance attestation which supersedes gitHead as a supply-chain integrity signal. ai
install-scripts install-script:preinstall AI (install-scripts): Only enforces pnpm package manager; no arbitrary code execution. ai
semgrep semgrep:dynamic-require AI (semgrep): Loads NAPI_RS_NATIVE_LIBRARY_PATH env var override; standard napi-rs escape hatch pattern. ai
semgrep semgrep:child-process-execsync AI (semgrep): Runs 'ldd --version' to detect musl libc for native binary selection; benign napi-rs pattern. ai
semgrep semgrep:child-process-import AI (semgrep): Same musl-detection usage; stable false positive for this native binding package. ai

Versions (showing 53 of 53)

Version Deps Published
0.14.3 0 / 12
0.14.2 0 / 12
0.14.1 0 / 11
0.14.0 0 / 11
0.13.1 0 / 11
0.13.0 0 / 11
0.12.0 0 / 11
0.11.0 0 / 11
0.10.1 0 / 11
0.10.0 0 / 11
0.9.2 0 / 11
0.9.1 0 / 11
0.9.0 0 / 11
0.8.2 0 / 11
0.8.1 0 / 11
0.8.0 0 / 11
0.7.6 0 / 11
0.7.5 0 / 11
0.7.4 0 / 11
0.7.3 0 / 11
0.7.2 0 / 11
0.7.1 0 / 11
0.7.0 0 / 10
0.6.1 0 / 10
0.6.0 0 / 10
0.5.4 0 / 7
0.5.3 0 / 7
0.5.2 0 / 7
0.5.1 0 / 7
0.5.0 0 / 6
0.4.7 0 / 5
0.4.6 0 / 5
0.4.5 0 / 5
0.4.4 0 / 5
0.4.3 0 / 5
0.4.2 0 / 5
0.4.1 0 / 5
0.4.0 0 / 5
0.3.2 0 / 5
0.3.1 0 / 5
0.3.0 0 / 5
0.2.5 0 / 5
0.2.4 0 / 5
0.2.3 0 / 5
0.2.2 0 / 3
0.2.1 0 / 3
0.2.0 0 / 3
0.1.5 0 / 2
0.1.4 0 / 2
0.1.3 0 / 2
0.1.2 0 / 0
0.1.1 0 / 2
0.1.0 0 / 0

v0.14.3

2 findings
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

INFO Missing gitHead — previous versions had it provenance

[Accepted risk] This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: GitHub Actions.

v0.4.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.4.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.3.2

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.3.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.3.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.2.5

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.2.4

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.2.3

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.2.2

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.2.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.2.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.1.5

2 findings
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: jindrich.bar → apify-service-account (on 2025-01-23, known maintainer) provenance

This version was published by a different npm account (apify-service-account) than the most recent previously approved version (jindrich.bar) on 2025-01-23, but apify-service-account is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

v0.1.4

2 findings
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: jindrich.bar → apify-service-account (on 2025-01-18, known maintainer) provenance

This version was published by a different npm account (apify-service-account) than the most recent previously approved version (jindrich.bar) on 2025-01-18, but apify-service-account is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

v0.1.3

2 findings
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: apify-service-account → jindrich.bar (on 2025-01-15, known maintainer) provenance

This version was published by a different npm account (jindrich.bar) than the most recent previously approved version (apify-service-account) on 2025-01-15, but jindrich.bar is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

v0.1.2

2 findings
HIGH Low-value / spam package indicators (6 signals, score 8) bogus-package

Matched 6 signal(s), weighted score 8: • [S_PUBLISHER_MASS_PRODUCTION] Maintainer 'jindrich.bar' owns 20 packages, ≥70% share a templated name shape. • [S_DESC_MATCHES_NAME] Description is empty or just restates the package name. • [S_NO_REPO_NO_HOME] No repository, homepage, or bugs URL — genuine packages almost always link somewhere. • [S_NO_KEYWORDS] No keywords declared. • [S_NO_DEPS] No runtime, dev, peer, or optional dependencies declared. • [S_TINY_PAYLOAD] Tiny payload: 0 code file(s), 219 bytes total.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.1.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.1.0

2 findings
HIGH Low-value / spam package indicators (6 signals, score 8) bogus-package

Matched 6 signal(s), weighted score 8: • [S_PUBLISHER_MASS_PRODUCTION] Maintainer 'jindrich.bar' owns 20 packages, ≥70% share a templated name shape. • [S_DESC_MATCHES_NAME] Description is empty or just restates the package name. • [S_NO_REPO_NO_HOME] No repository, homepage, or bugs URL — genuine packages almost always link somewhere. • [S_NO_KEYWORDS] No keywords declared. • [S_NO_DEPS] No runtime, dev, peer, or optional dependencies declared. • [S_TINY_PAYLOAD] Tiny payload: 0 code file(s), 219 bytes total.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.