← Home

llamaindex

npm Repository Homepage
51
Versions
—
License
No
Install Scripts
Missing
Provenance

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures No source commit

Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.

Maintainers

himself_65marcusschiessercheesyfishes

Keywords

llmllamaopenaigptdata sciencepromptprompt engineeringchatgptmachine learningmlembeddingvectorstoredata frameworkllamaindex

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
npm-metadata bundled-binaries AI (npm-metadata): ONNX runtime wasm from @xenova/transformers, a declared dep; content-verified tree. ai
semgrep semgrep:base64-decode AI (semgrep): Legit base64 data-URL decoding for Blob conversion, not payload hiding. ai
dependencies unvetted-dep:tiktoken-node AI (dependencies): Standard tokenizer dep for LLM library, not malicious. ai
phantom-deps phantom-dep:js-tiktoken AI (phantom-deps): Likely used via bundled build output; benign tokenizer dep. ai
dependencies unvetted-dep:@llamaindex/chroma AI (dependencies): First-party @llamaindex scoped sibling package from same monorepo. ai
maintainer-change maintainer-removed AI (maintainer-change): Long-tenured publisher with 232 approved packages; consistent with normal maintainer roster change. ai
phantom-deps phantom-dep:@discoveryjs/json-ext AI (phantom-deps): Config-only usage pattern typical for this package's build tooling. ai
provenance publisher-changed AI (provenance): Legit maintainer transition within run-llama org; publisher has clean track record. ai
phantom-deps phantom-dep:@llamaindex/workflow AI (phantom-deps): First-party workspace package referenced via config/subpath exports. ai
phantom-deps phantom-dep:magic-bytes.js AI (phantom-deps): Used indirectly; stable false positive for this package. ai
dependencies unvetted-dep:@llamaindex/groq AI (dependencies): First-party llamaindex provider sub-package, expected in monorepo split. ai
dependencies unvetted-dep:chromadb-default-embed AI (dependencies): Known chromadb embedding helper package, benign. ai
publish-pattern new-deps-added AI (publish-pattern): Deps reflect monorepo split into @llamaindex/* provider packages, not injected code. ai
phantom-deps phantom-dep:@aws-crypto/sha256-js AI (phantom-deps): Used indirectly by AWS-backed vector stores. ai
dependencies unvetted-dep:wikipedia AI (dependencies): Documented data-loader integration for llamaindex connectors. ai
dependencies unvetted-dep:portkey-ai AI (dependencies): LLM gateway integration matching package purpose. ai
dependencies unvetted-dep:md-utils-ts AI (dependencies): Markdown utility used by document loaders. ai
dependencies unvetted-dep:rake-modified AI (dependencies): Keyword-extraction util, benign small dep. ai
dependencies unvetted-dep:notion-md-crawler AI (dependencies): Notion connector integration matching stated purpose. ai
phantom-deps phantom-dep:pathe AI (phantom-deps): Used indirectly via config/build tooling. ai
phantom-deps phantom-dep:wink-nlp AI (phantom-deps): NLP dep loaded by convention in loaders. ai
phantom-deps phantom-dep:@types/pg AI (phantom-deps): Type-only package, framework convention. ai
phantom-deps phantom-dep:md-utils-ts AI (phantom-deps): Used indirectly, config-referenced. ai
phantom-deps phantom-dep:@types/papaparse AI (phantom-deps): Type-only package, framework convention. ai
phantom-deps phantom-dep:@types/lodash AI (phantom-deps): Type-only dep for lodash; benign. ai
phantom-deps phantom-dep:@types/node AI (phantom-deps): Type-only framework-scoped dep, loaded by convention. ai
provenance no-provenance AI (provenance): Established high-trust package; no provenance is common and not a disqualifier here. ai

Versions (showing 51 of 150)

View all versions
Version Deps Published
0.12.1 8 / 2
0.10.2 11 / 1
0.10.1 11 / 1
0.10.0 11 / 1
0.9.19 11 / 5
0.9.18 11 / 5
0.9.17 11 / 5
0.9.16 11 / 5
0.9.15 12 / 5
0.9.14 12 / 5
0.9.13 12 / 5
0.9.12 12 / 5
0.9.11 12 / 5
0.9.10 12 / 5
0.9.9 11 / 5
0.9.8 11 / 5
0.9.7 11 / 5
0.9.6 12 / 5
0.9.5 11 / 5
0.9.4 11 / 5
0.9.3 11 / 5
0.9.2 11 / 5
0.9.1 11 / 5
0.9.0 11 / 5
0.8.34 35 / 5
0.8.7 51 / 10
0.8.5 51 / 10
0.8.3 50 / 10
0.8.2 49 / 10
0.8.0 49 / 10
0.6.8 50 / 9
0.6.0 49 / 8
0.5.27 49 / 8
0.5.26 48 / 8
0.5.25 48 / 8
0.5.24 50 / 6
0.5.23 50 / 6
0.5.22 50 / 6
0.5.21 50 / 6
0.5.20 49 / 6
0.5.19 49 / 6
0.5.18 49 / 6
0.5.17 49 / 6
0.5.16 48 / 6
0.5.15 48 / 6
0.5.14 48 / 6
0.5.13 48 / 6
0.5.12 48 / 6
0.5.11 48 / 6
0.5.10 48 / 6
0.5.9 48 / 6

v0.12.1

2 findings
HIGH Publisher changed: himself_65 → cheesyfishes (on 2025-12-02) provenance

This version was published by a different npm account than previous versions on 2025-12-02. This could indicate a legitimate maintainer transition or an account compromise.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.10.2

1 finding
HIGH No provenance attestation provenance

[Reject — re-review on republish] (prior reject: AI (provenance): Combined with a new publisher and private:true package.json, lack of provenance is a disqualifier for this package.) Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.10.1

1 finding
HIGH No provenance attestation provenance

[Reject — re-review on republish] (prior reject: AI (provenance): Combined with a new publisher and private:true package.json, lack of provenance is a disqualifier for this package.) Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.10.0

1 finding
HIGH No provenance attestation provenance

[Reject — re-review on republish] (prior reject: AI (provenance): Combined with a new publisher and private:true package.json, lack of provenance is a disqualifier for this package.) Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.9.19

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.9.18

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.9.17

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.9.16

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.9.15

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.9.14

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.9.13

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.9.12

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.9.11

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.9.10

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.9.9

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.9.8

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.9.7

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.9.6

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.9.5

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.9.4

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.9.3

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.9.2

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.9.1

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.9.0

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.8.34

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.8.7

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.8.5

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.8.3

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.8.2

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.8.0

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.6.8

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.6.0

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.5.27

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.5.26

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.5.25

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.5.24

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.5.23

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.5.22

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.5.21

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.5.20

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.5.19

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.5.18

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.5.17

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.5.16

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.5.15

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.5.14

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.5.13

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.5.12

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.5.11

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.5.10

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.5.9

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.