← Home

metro-core

npm Repository Homepage

🚇 Metro's core package.

51
Versions
MIT
License
No
Install Scripts
Verified
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures gitHead linked

Maintainers

fbmetro-bot

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
provenance missing-githead AI (provenance): Known Metro CI publish env; gitHead absence is not malicious for this package. ai
publish-pattern new-deps-added AI (publish-pattern): jest-haste-map is an established first-party dep; normal for Metro. ai
npm-metadata suspicious-initial-version AI (npm-metadata): Known legitimate package; 0.0.0 is a placeholder publish, not malicious throwaway. ai
bogus-package bogus-package AI (bogus-package): metro-core is a monorepo sub-package of facebook/metro; sparse README and no keywords are expected for internal sub-packages, not spam indicators. ai
phantom-deps phantom-dep:flow-enums-runtime AI (phantom-deps): flow-enums-runtime is a standard transitive requirement for Flow-typed packages; its presence as a declared dep without direct import is normal for this package family. ai

Versions (showing 51 of 181)

View all versions
Version Deps Published
0.87.0 3 / 0
0.86.0 3 / 0
0.85.0 3 / 0
0.84.4 3 / 0
0.84.3 3 / 0
0.84.2 3 / 0
0.84.1 3 / 0
0.84.0 3 / 0
0.83.7 3 / 0
0.83.6 3 / 0
0.83.5 3 / 0
0.83.4 3 / 0
0.83.3 3 / 0
0.83.2 3 / 0
0.83.1 3 / 0
0.83.0 3 / 0
0.82.5 3 / 0
0.82.4 3 / 0
0.82.3 3 / 0
0.82.2 3 / 0
0.82.1 3 / 0
0.82.0 3 / 0
0.81.5 3 / 0
0.81.4 3 / 0
0.81.3 3 / 0
0.81.2 3 / 0
0.81.1 3 / 0
0.81.0 3 / 0
0.80.12 3 / 0
0.80.11 3 / 0
0.80.10 3 / 0
0.80.9 2 / 0
0.80.8 2 / 0
0.80.7 2 / 0
0.80.6 2 / 0
0.80.5 2 / 0
0.80.4 2 / 0
0.80.3 2 / 0
0.80.2 2 / 0
0.80.1 2 / 0
0.80.0 2 / 0
0.79.1 2 / 0
0.79.0 2 / 0
0.78.1 2 / 0
0.78.0 2 / 0
0.77.0 2 / 0
0.76.9 2 / 0
0.76.8 2 / 0
0.76.7 2 / 0
0.76.6 2 / 0
0.76.5 2 / 0

v0.87.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.86.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.80.8

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.80.7

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.80.6

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.80.5

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.80.4

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.80.3

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.80.2

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.80.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.80.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.79.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.79.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.78.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.78.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.77.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.76.9

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.76.8

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.76.7

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.76.6

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.76.5

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.