inversify
A powerful and lightweight inversion of control container for JavaScript and Node.js apps powered by TypeScript.
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | obfuscated-file:lib/esm/index.js | AI (source-diff): lib/esm/index.js is a rollup+terser minified ESM bundle, as confirmed by the build:esm script using @rollup/plugin-terser. Content is readable minified InversifyJS source, not obfuscation. | ai | |
| source-diff | large-new-source-files | AI (source-diff): New files result from build system refactoring (AMD/ES/lib outputs replaced with CJS+ESM dual-package structure). Legitimate restructuring, not injected code. | ai | |
| source-diff | source-size-dropped | AI (source-diff): Size drop from 1MB to 254KB reflects removal of legacy AMD/ES/lib build outputs in favor of a leaner CJS+ESM dual-package structure. | ai | |
| provenance | missing-githead | AI (provenance): inversify is a well-established package; missing gitHead reflects a publish environment change, not a security concern. No other suspicious signals present. | ai | |
| provenance | no-provenance | AI (provenance): InversifyJS is a well-established package with a trusted publisher; lack of Sigstore provenance is a process gap, not a security threat for this package. | ai |
Versions (showing 51 of 95)
| Version | Deps | Published |
|---|---|---|
| 8.2.3 | 3 / 9 | |
| 8.2.2 | 3 / 9 | |
| 8.2.1 | 3 / 9 | |
| 8.2.0 | 3 / 9 | |
| 8.1.3 | 3 / 9 | |
| 8.1.2 | 3 / 9 | |
| 8.1.1 | 3 / 9 | |
| 8.1.0 | 3 / 10 | |
| 8.0.0 | 3 / 10 | |
| 7.11.0 | 3 / 11 | |
| 7.10.8 | 3 / 11 | |
| 7.10.7 | 3 / 11 | |
| 7.10.6 | 3 / 11 | |
| 7.10.5 | 3 / 11 | |
| 7.10.4 | 3 / 11 | |
| 7.10.3 | 3 / 11 | |
| 7.10.2 | 3 / 11 | |
| 7.10.1 | 3 / 11 | |
| 7.10.0 | 3 / 26 | |
| 7.9.1 | 3 / 26 | |
| 7.9.0 | 3 / 26 | |
| 7.8.1 | 3 / 26 | |
| 7.8.0 | 3 / 26 | |
| 7.7.1 | 3 / 26 | |
| 7.7.0 | 3 / 26 | |
| 7.6.1 | 3 / 23 | |
| 7.6.0 | 3 / 23 | |
| 7.5.4 | 3 / 23 | |
| 7.5.3 | 3 / 23 | |
| 7.5.2 | 3 / 23 | |
| 7.5.1 | 3 / 23 | |
| 7.5.0 | 3 / 23 | |
| 7.4.0 | 3 / 23 | |
| 7.3.0 | 3 / 23 | |
| 7.2.0 | 3 / 23 | |
| 7.1.0 | 3 / 23 | |
| 7.0.2 | 3 / 23 | |
| 7.0.1 | 3 / 23 | |
| 7.0.0 | 3 / 23 | |
| 6.2.2 | 2 / 23 | |
| 6.2.1 | 2 / 23 | |
| 6.2.0 | 2 / 23 | |
| 6.1.6 | 2 / 23 | |
| 6.1.5 | 2 / 23 | |
| 6.1.4 | 2 / 25 | |
| 6.1.3 | 2 / 22 | |
| 6.1.2 | 2 / 22 | |
| 6.1.1 | 2 / 22 | |
| 6.0.2 | 0 / 14 | |
| 6.0.1 | 0 / 27 | |
| 5.1.1 | 0 / 31 |
v8.2.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v8.2.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v8.2.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v8.2.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v8.1.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v8.1.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.