metro-core MIT 81 versions

metro-core

npm Repository Homepage

🚇 Metro's core package.

81

Versions

MIT

License

No

Install Scripts

Verified

Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures gitHead linked

Maintainers

fbmetro-bot

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
provenance	missing-githead	AI (provenance): Known Metro CI publish env; gitHead absence is not malicious for this package.	ai	2026/07/19
publish-pattern	new-deps-added	AI (publish-pattern): jest-haste-map is an established first-party dep; normal for Metro.	ai	2026/07/19
npm-metadata	suspicious-initial-version	AI (npm-metadata): Known legitimate package; 0.0.0 is a placeholder publish, not malicious throwaway.	ai	2026/07/19
bogus-package	bogus-package	AI (bogus-package): metro-core is a monorepo sub-package of facebook/metro; sparse README and no keywords are expected for internal sub-packages, not spam indicators.	ai	2026/04/21
phantom-deps	phantom-dep:flow-enums-runtime	AI (phantom-deps): flow-enums-runtime is a standard transitive requirement for Flow-typed packages; its presence as a declared dep without direct import is normal for this package family.	ai	2026/04/21

Versions (showing 81 of 181)

Version	Deps	Published
0.59.0	4 / 0	2020-03-19
0.58.0	4 / 0	2020-01-19
0.57.0	4 / 0	2019-10-31
0.56.4	4 / 0	2020-01-08
0.56.3	4 / 0	2019-10-24
0.56.0	4 / 0	2019-08-12
0.55.0	4 / 0	2019-07-04
0.54.1	4 / 0	2019-05-14
0.54.0	4 / 0	2019-05-01
0.53.1	4 / 0	2019-03-14
0.53.0	4 / 0	2019-03-01
0.52.0	4 / 0	2019-02-19
0.51.1	4 / 0	2018-12-21
0.51.0	4 / 0	2018-12-18
0.50.0	4 / 0	2018-11-29
0.49.2	4 / 0	2018-11-15
0.49.1	4 / 0	2018-11-12
0.49.0	4 / 0	2018-10-30
0.48.5	4 / 0	2018-12-12
0.48.4	4 / 0	2018-12-12
0.48.3	4 / 0	2018-10-29
0.48.2	4 / 0	2018-10-27
0.48.1	4 / 0	2018-10-10
0.48.0	4 / 0	2018-10-05
0.47.1	4 / 0	2018-10-04
0.47.0	4 / 0	2018-09-27
0.46.0	4 / 0	2018-09-24
0.45.6	4 / 0	2018-09-21
0.45.5	4 / 0	2018-09-20
0.45.4	4 / 0	2018-09-19
0.45.3	4 / 0	2018-09-14
0.45.2	4 / 0	2018-09-12
0.45.1	4 / 0	2018-09-06
0.45.0	4 / 0	2018-08-30
0.44.0	4 / 0	2018-08-28
0.43.6	4 / 0	2018-08-16
0.43.5	4 / 0	2018-08-10
0.43.4	4 / 0	2018-08-03
0.43.3	4 / 0	2018-08-02
0.43.2	4 / 0	2018-08-01
0.43.1	4 / 0	2018-07-30
0.43.0	4 / 0	2018-07-27
0.42.2	4 / 0	2018-07-20
0.42.1	4 / 0	2018-07-10
0.40.1	4 / 0	2018-06-28
0.40.0	4 / 0	2018-06-20
0.39.1	4 / 0	2018-06-14
0.39.0	4 / 0	2018-06-12
0.38.4	4 / 0	2018-08-01
0.38.3	4 / 0	2018-07-13
0.38.2	4 / 0	2018-07-11
0.38.1	4 / 0	2018-06-04
0.38.0	4 / 0	2018-06-01
0.37.2	4 / 0	2018-06-01
0.37.1	4 / 0	2018-05-21
0.37.0	4 / 0	2018-05-15
0.36.1	4 / 0	2018-04-27
0.36.0	4 / 0	2018-04-27
0.35.0	4 / 0	2018-04-26
0.34.0	4 / 0	2018-04-20
0.33.0	4 / 0	2018-04-18
0.32.0	4 / 0	2018-04-13
0.31.0	2 / 0	2018-03-21
0.30.2	2 / 0	2018-03-16
0.30.1	2 / 0	2018-03-14
0.30.0	2 / 0	2018-03-10
0.29.0	2 / 0	2018-03-07
0.28.0	1 / 0	2018-02-26
0.27.0	1 / 0	2018-02-24
0.26.0	1 / 0	2018-02-13
0.25.1	1 / 0	2018-02-07
0.25.0	1 / 0	2018-02-06
0.24.7	1 / 0	2018-01-25
0.24.6	1 / 0	2018-01-19
0.24.5	1 / 0	2018-01-19
0.24.4	0 / 0	2018-01-12
0.24.3	0 / 0	2017-12-21
0.24.2	0 / 0	2017-12-20
0.24.1	0 / 0	2017-12-15
0.24.0	0 / 0	2017-12-15
0.0.0	0 / 0	2017-11-30

v0.59.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.58.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.57.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.56.4

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.56.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.56.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.55.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.54.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.54.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.53.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.53.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.52.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.51.1

2 findings

MEDIUM Publisher changed: rafeca → metro-bot (on 2018-12-21, unremoved on npm for 2766d) provenance

This version was published by a different npm account (metro-bot) than the most recent previously approved version (rafeca) on 2018-12-21. It has since remained available on npm for 2766 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.51.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.50.0

2 findings

MEDIUM Publisher changed: rafeca → metro-bot (on 2018-11-29, unremoved on npm for 2788d) provenance

This version was published by a different npm account (metro-bot) than the most recent previously approved version (rafeca) on 2018-11-29. It has since remained available on npm for 2788 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.49.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.49.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.49.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.48.5

2 findings

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: metro-bot → rafeca (on 2018-12-12, known maintainer) provenance

This version was published by a different npm account (rafeca) than the most recent previously approved version (metro-bot) on 2018-12-12, but rafeca is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

v0.48.4

2 findings

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: metro-bot → rafeca (on 2018-12-12, known maintainer) provenance

This version was published by a different npm account (rafeca) than the most recent previously approved version (metro-bot) on 2018-12-12, but rafeca is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

v0.48.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.48.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.48.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.48.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.47.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.47.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.46.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.45.6

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.45.5

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.45.4

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.45.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.45.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.45.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.45.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.44.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.43.6

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.43.5

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.43.4

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.43.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.43.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.43.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.43.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.42.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.42.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.40.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.40.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.39.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.39.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.38.4

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.38.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.38.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.38.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.38.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.37.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.37.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.37.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.36.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.36.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.35.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.34.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.33.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.32.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.31.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.30.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.30.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.30.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.29.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.28.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.27.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.26.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.25.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.25.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.24.7

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.24.6

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.24.5

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.24.4

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.24.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.24.2

2 findings

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: kuvos → rafeca (on 2017-12-20, known maintainer) provenance

This version was published by a different npm account (rafeca) than the most recent previously approved version (kuvos) on 2017-12-20, but rafeca is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

v0.24.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.24.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.0.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.