metro-source-map — Greenflagged

🚇 Source map generator for Metro.

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures gitHead linked

Maintainers

fbmetro-bot

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
provenance	missing-githead	AI (provenance): Trusted metro-bot publisher; publish-env change on canonical Metro package, not a risk signal.	ai	2026/07/21
npm-metadata	suspicious-initial-version	AI (npm-metadata): Metro monorepo packages use 0.0.0 placeholder versioning; established high-trust package.	ai	2026/07/21
npm-metadata	no-description	AI (npm-metadata): Minor metadata gap, not indicative of risk for this established package.	ai	2026/07/21
publish-pattern	new-deps-added	AI (publish-pattern): Alias dep of existing @babel/traverse dependency already present; not a novel supply-chain risk.	ai	2026/07/08
phantom-deps	phantom-dep:@babel/traverse	AI (phantom-deps): Loaded via the alias @babel/traverse--for-generate-function-map; phantom-dep false positive for this package.	ai	2026/05/09
dependencies	unvetted-dep:@babel/traverse--for-generate-function-map	AI (dependencies): npm alias for @babel/traverse; same vetted package under a different local name, stable pattern in metro monorepo.	ai	2026/05/09
provenance	publisher-changed	AI (provenance): Meta/Facebook migrated metro releases to GitHub Actions CI; SLSA attestation confirms legitimate CI/CD provenance.	ai	2026/04/28
bogus-package	bogus-package	AI (bogus-package): metro-source-map is a monorepo sub-package; short README and no keywords are expected for internal ecosystem packages published from facebook/metro.	ai	2026/04/21
phantom-deps	phantom-dep:flow-enums-runtime	AI (phantom-deps): flow-enums-runtime is a Flow type runtime used in the metro ecosystem; phantom-dep finding is expected for monorepo packages with shared type dependencies.	ai	2026/04/21

Versions (showing 100 of 182)

Version	Deps	Published
0.87.0	9 / 3	2026-07-13
0.86.0	9 / 3	2026-07-06
0.85.0	9 / 3	2026-06-23
0.84.4	9 / 3	2026-04-30
0.84.3	9 / 3	2026-04-13
0.84.2	9 / 3	2026-02-27
0.84.1	9 / 3	2026-02-25
0.84.0	9 / 3	2026-02-20
0.83.7	9 / 3	2026-04-29
0.83.6	9 / 3	2026-04-13
0.83.5	9 / 3	2026-03-01
0.83.4	9 / 3	2026-02-20
0.83.3	10 / 3	2025-10-01
0.83.2	10 / 3	2025-09-18
0.83.1	10 / 3	2025-07-24
0.83.0	10 / 3	2025-07-13
0.82.5	10 / 3	2025-07-06
0.82.4	10 / 3	2025-05-21
0.82.3	10 / 3	2025-05-06
0.82.2	10 / 3	2025-04-29
0.82.1	10 / 3	2025-03-27
0.82.0	10 / 3	2025-03-06
0.81.5	10 / 3	2025-05-06
0.81.4	10 / 3	2025-03-20
0.81.3	10 / 3	2025-03-03
0.81.2	10 / 3	2025-02-25
0.81.1	10 / 3	2025-01-30
0.81.0	10 / 3	2024-10-14
0.80.12	9 / 3	2024-09-08
0.80.11	9 / 3	2024-09-04
0.80.10	9 / 3	2024-08-08
0.80.9	8 / 3	2024-05-02
0.80.8	8 / 3	2024-03-28
0.80.7	8 / 3	2024-03-19
0.80.6	8 / 3	2024-02-15
0.80.5	8 / 3	2024-01-24
0.80.4	8 / 3	2024-01-10
0.80.3	8 / 3	2024-01-03
0.80.2	8 / 3	2023-12-18
0.80.1	8 / 3	2023-11-09
0.80.0	8 / 3	2023-10-25
0.79.1	8 / 3	2023-09-19
0.79.0	8 / 3	2023-09-01
0.78.1	8 / 3	2023-08-16
0.78.0	8 / 3	2023-08-07
0.77.0	8 / 3	2023-07-06
0.76.9	8 / 3	2024-01-30
0.76.8	8 / 3	2023-08-07
0.76.7	8 / 3	2023-06-21
0.76.6	8 / 3	2023-06-07
0.76.5	8 / 3	2023-05-25
0.76.4	8 / 3	2023-05-10
0.76.3	8 / 3	2023-04-24
0.76.2	8 / 3	2023-04-14
0.76.1	8 / 3	2023-04-03
0.76.0	8 / 3	2023-03-06
0.75.1	8 / 3	2023-02-22
0.75.0	8 / 3	2023-02-01
0.74.1	8 / 3	2023-01-20
0.74.0	8 / 3	2023-01-09
0.73.10	8 / 2	2023-06-07
0.73.9	8 / 2	2023-03-21
0.73.8	8 / 2	2023-02-20
0.73.7	8 / 2	2023-01-05
0.73.6	8 / 2	2022-12-15
0.73.5	8 / 2	2022-12-01
0.73.4	8 / 2	2022-12-01
0.73.3	8 / 2	2022-10-26
0.73.2	8 / 2	2022-10-13
0.73.1	8 / 2	2022-10-06
0.73.0	8 / 2	2022-10-04
0.72.4	8 / 2	2023-06-07
0.72.3	8 / 2	2022-09-14
0.72.2	8 / 2	2022-09-05
0.72.1	8 / 2	2022-08-18
0.72.0	8 / 2	2022-07-28
0.71.3	8 / 2	2022-07-06
0.71.2	8 / 2	2022-06-27
0.71.1	8 / 2	2022-06-10
0.71.0	8 / 2	2022-05-23
0.70.4	8 / 2	2023-06-07
0.70.3	8 / 2	2022-05-05
0.70.2	8 / 2	2022-04-22
0.70.1	8 / 2	2022-04-07
0.70.0	8 / 2	2022-03-28
0.69.1	8 / 2	2022-03-15
0.69.0	8 / 2	2022-02-26
0.68.0	8 / 2	2022-02-09
0.67.0	8 / 2	2022-01-26
0.66.2	8 / 2	2021-07-20
0.66.1	8 / 2	2021-07-05
0.66.0	8 / 2	2021-04-20
0.65.2	8 / 2	2021-03-03
0.65.1	8 / 2	2021-02-15
0.65.0	8 / 2	2021-01-28
0.64.0	8 / 2	2020-11-05
0.63.0	7 / 2	2020-08-21
0.62.0	7 / 2	2020-08-10
0.61.0	7 / 2	2020-07-21
0.60.0	7 / 2	2020-06-30

Showing 100 of 182 Next page →

v0.87.0

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.86.0

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.82.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.82.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.81.4

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.81.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.81.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.81.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.81.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.80.12

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.80.11

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.80.10

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.80.9

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.80.8

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.80.7

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.80.6

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.80.5

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.80.4

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.80.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.80.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.80.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.80.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.79.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.79.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.78.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.78.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.77.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.76.9

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.76.8

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.76.7

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.76.6

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.76.5

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.76.4

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.76.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.76.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.76.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.76.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.75.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.75.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.74.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.74.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.73.10

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.73.9

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.73.8

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.73.7

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.73.6

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.73.5

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.73.4

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.73.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.73.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.73.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.73.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.72.4

2 findings

HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: metro-bot.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.72.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.72.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.72.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.72.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.71.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.71.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.71.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.71.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.70.4

2 findings

HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: metro-bot.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.70.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.70.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.70.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.70.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.69.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.69.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.68.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.67.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.66.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.66.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.66.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.65.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.65.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.65.0

2 findings

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: cpojer → metro-bot (on 2021-01-28, known maintainer) provenance

This version was published by a different npm account (metro-bot) than the most recent previously approved version (cpojer) on 2021-01-28, but metro-bot is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

v0.64.0

2 findings

MEDIUM Publisher changed: metro-bot → cpojer (on 2020-11-05, unremoved on npm for 2084d) provenance

This version was published by a different npm account (cpojer) than the most recent previously approved version (metro-bot) on 2020-11-05. It has since remained available on npm for 2084 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.63.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.62.0

2 findings

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: cpojer → metro-bot (on 2020-08-10, known maintainer) provenance

This version was published by a different npm account (metro-bot) than the most recent previously approved version (cpojer) on 2020-08-10, but metro-bot is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

v0.61.0

2 findings

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: cpojer → metro-bot (on 2020-07-21, known maintainer) provenance

This version was published by a different npm account (metro-bot) than the most recent previously approved version (cpojer) on 2020-07-21, but metro-bot is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

v0.60.0

2 findings

MEDIUM Publisher changed: metro-bot → cpojer (on 2020-06-30, unremoved on npm for 2212d) provenance

This version was published by a different npm account (cpojer) than the most recent previously approved version (metro-bot) on 2020-06-30. It has since remained available on npm for 2212 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.