logform
An mutable object-based log format designed for chaining & objectMode streams.
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| publish-pattern | dormant-publish | AI (publish-pattern): Established winstonjs ecosystem package; dormancy reflects org maintenance cadence, not takeover. | ai | |
| publish-pattern | new-deps-added | AI (publish-pattern): Deps are direct replacements (colors→@colors/colors, fast-safe-stringify→safe-stable-stringify); well-known packages. | ai | |
| maintainer-change | maintainer-added | AI (maintainer-change): New maintainers are winstonjs org contributors; consistent with legitimate project governance. | ai | |
| semgrep | semgrep:dynamic-require | AI (semgrep): Lazy-loads known local format modules by name; path is not user-controlled. Stable pattern across all logform versions. | ai | |
| dependencies | unvetted-dep:fecha | AI (dependencies): fecha is a well-known date formatting library with no security concerns; stable dependency for logform. | ai | |
| phantom-deps | phantom-dep:@types/triple-beam | AI (phantom-deps): Type-only package loaded by convention (TypeScript types); not directly imported at runtime, expected pattern. | ai | |
| dependencies | unvetted-dep:triple-beam | AI (dependencies): triple-beam is a core winstonjs-org package for shared log level constants; expected dependency for logform. | ai | |
| dependencies | unvetted-dep:@colors/colors | AI (dependencies): @colors/colors is the maintained fork of the colors package; no security concerns for logform's use. | ai | |
| dependencies | unvetted-dep:@types/triple-beam | AI (dependencies): @types/triple-beam is a TypeScript type definition package for triple-beam; benign for logform. | ai |
Versions (showing 16 of 16)
| Version | Deps | Published |
|---|---|---|
| 2.7.0 | 6 / 9 | |
| 2.6.1 | 6 / 9 | |
| 2.6.0 | 6 / 9 | |
| 2.5.1 | 6 / 9 | |
| 2.5.0 | 5 / 10 | |
| 2.4.2 | 5 / 9 | |
| 2.4.1 | 5 / 9 | |
| 2.4.0 | 5 / 9 | |
| 2.3.2 | 5 / 8 | |
| 2.3.1 | 5 / 8 | |
| 2.3.0 | 5 / 8 | |
| 2.2.0 | 5 / 8 | |
| 2.1.2 | 5 / 8 | |
| 2.1.1 | 5 / 7 | |
| 2.1.0 | 5 / 7 | |
| 2.0.0 | 5 / 7 |
v2.6.0
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (dabh) than the most recent previously approved version (w-b-t) on 2023-10-13, but dabh is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v2.5.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.5.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.4.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.4.1
2 findingsThis version was published by a different npm account (w-b-t) than the most recent previously approved version (dabh) on 2022-06-21. It has since remained available on npm for 1489 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.4.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.3.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.3.1
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (dabh) than the most recent previously approved version (yurijmikhalevich) on 2022-01-10, but dabh is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v2.3.0
2 findingsThis version was published by a different npm account (yurijmikhalevich) than the most recent previously approved version (dabh) on 2021-09-22. It has since remained available on npm for 1761 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.1.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.1.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.1.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.0.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.