libnpmfund
Programmatic API for npm fund
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| maintainer-change | maintainer-added | AI (maintainer-change): New maintainers (fritzy, gar, lukekarrys) are known npm/GitHub staff; this is a routine internal team transition for an npm-owned package. | ai | |
| npm-metadata | suspicious-initial-version | AI (npm-metadata): libnpmfund is an official npm CLI package; 0.0.0 is a standard bootstrapping version for npm's own libraries, not a malware indicator. | ai | |
| bogus-package | bogus-package | AI (bogus-package): Flag is triggered by isaacs being listed as a spam publisher, but isaacs is the npm founder. This is a stable false positive for npm-org packages. | ai | |
| provenance | missing-githead | AI (provenance): libnpmfund is an official npm CLI workspace package published by known npm org members; missing gitHead reflects a publish environment change, not a security concern. | ai | |
| provenance | publisher-changed | AI (provenance): reggi is a known npm/GitHub employee and established publisher; transition from owlstronaut to reggi on an official npm/cli workspace package is a legitimate internal handoff. | ai | |
| maintainer-change | maintainer-removed | AI (maintainer-change): Maintainer rotation is routine in the npm CLI org; package is part of the official npm/cli monorepo published by GitHub Inc., making hostile takeover implausible. | ai | |
| dependencies | unvetted-dep:@npmcli/arborist | AI (dependencies): @npmcli/arborist is a first-party npm CLI dependency from the same GitHub org; its use in libnpmfund is expected and stable across versions. | ai | |
| provenance | no-provenance | AI (provenance): Official npm CLI workspace package from GitHub Inc.; lack of Sigstore provenance is not a meaningful risk signal for this well-known package. | ai |
Versions (showing 51 of 86)
| Version | Deps | Published |
|---|---|---|
| 8.0.1 | 1 / 3 | |
| 8.0.0 | 1 / 3 | |
| 7.0.25 | 1 / 3 | |
| 7.0.24 | 1 / 3 | |
| 7.0.23 | 1 / 3 | |
| 7.0.22 | 1 / 3 | |
| 7.0.21 | 1 / 3 | |
| 7.0.20 | 1 / 3 | |
| 7.0.19 | 1 / 3 | |
| 7.0.18 | 1 / 3 | |
| 7.0.17 | 1 / 3 | |
| 7.0.16 | 1 / 3 | |
| 7.0.15 | 1 / 3 | |
| 7.0.14 | 1 / 3 | |
| 7.0.13 | 1 / 3 | |
| 7.0.12 | 1 / 3 | |
| 7.0.11 | 1 / 3 | |
| 7.0.10 | 1 / 3 | |
| 7.0.9 | 1 / 3 | |
| 7.0.8 | 1 / 3 | |
| 7.0.7 | 1 / 3 | |
| 7.0.6 | 1 / 3 | |
| 7.0.5 | 1 / 3 | |
| 7.0.4 | 1 / 3 | |
| 7.0.3 | 1 / 3 | |
| 7.0.2 | 1 / 3 | |
| 7.0.1 | 1 / 3 | |
| 7.0.0 | 1 / 3 | |
| 6.0.5 | 1 / 3 | |
| 6.0.4 | 1 / 3 | |
| 6.0.3 | 1 / 3 | |
| 6.0.2 | 1 / 3 | |
| 6.0.1 | 1 / 3 | |
| 6.0.0 | 1 / 3 | |
| 5.0.12 | 1 / 3 | |
| 5.0.11 | 1 / 3 | |
| 5.0.10 | 1 / 3 | |
| 5.0.9 | 1 / 3 | |
| 5.0.8 | 1 / 3 | |
| 5.0.7 | 1 / 3 | |
| 5.0.6 | 1 / 3 | |
| 5.0.5 | 1 / 3 | |
| 5.0.4 | 1 / 3 | |
| 5.0.3 | 1 / 3 | |
| 5.0.2 | 1 / 3 | |
| 5.0.1 | 1 / 3 | |
| 5.0.0 | 1 / 3 | |
| 4.2.2 | 1 / 3 | |
| 4.2.1 | 1 / 3 | |
| 4.1.1 | 1 / 3 | |
| 4.1.0 | 1 / 3 |
v8.0.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v8.0.0
2 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (reggi) than the most recent previously approved version (owlstronaut) on 2026-07-08, but reggi is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v7.0.25
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.