oas
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| npm-metadata | url-dep:jest-expect-openapi | AI (npm-metadata): Monorepo file: reference in devDependencies only; no runtime impact. | ai | |
| npm-metadata | url-dep:@readme/oas-examples | AI (npm-metadata): Monorepo file: reference in devDependencies only; no runtime impact. | ai | |
| npm-metadata | url-dep:jest-expect-jsonschema | AI (npm-metadata): Monorepo file: reference in devDependencies only; no runtime impact. | ai | |
| typosquat | typosquat.levenshtein:koa | AI (typosquat): 'oas' is a well-known acronym for OpenAPI Specification; this 3325-day-old package with 332 versions is not a typosquat of 'koa'. | ai | |
| phantom-deps | phantom-dep:@types/json-schema | AI (phantom-deps): @types/json-schema is intentionally a runtime dep for re-exported TypeScript types in this OpenAPI tooling library; stable pattern for this package. | ai | |
| typosquat | typosquat.levenshtein:cors | AI (typosquat): 'oas' stands for OpenAPI Specification; not a typosquat of 'cors'. Package has 332 versions and 3325 days of history. | ai | |
| typosquat | typosquat.levenshtein:qs | AI (typosquat): 'oas' stands for OpenAPI Specification; not a typosquat of 'qs'. Package has 332 versions and 3325 days of history. | ai |
Versions (showing 55 of 55)
| Version | Deps | Published |
|---|---|---|
| 38.1.0 | 8 / 8 | |
| 38.0.1 | 8 / 8 | |
| 38.0.0 | 8 / 8 | |
| 37.2.0 | 8 / 8 | |
| 37.1.0 | 8 / 8 | |
| 37.0.0 | 8 / 8 | |
| 36.0.3 | 9 / 8 | |
| 36.0.2 | 10 / 9 | |
| 36.0.1 | 10 / 9 | |
| 36.0.0 | 10 / 9 | |
| 34.1.0 | 10 / 9 | |
| 34.0.2 | 10 / 9 | |
| 34.0.1 | 10 / 9 | |
| 33.2.0 | 10 / 9 | |
| 33.1.5 | 10 / 9 | |
| 33.1.4 | 10 / 9 | |
| 33.1.3 | 10 / 9 | |
| 33.0.0 | 10 / 9 | |
| 32.1.18 | 10 / 9 | |
| 32.1.17 | 10 / 9 | |
| 32.1.16 | 10 / 9 | |
| 32.1.15 | 10 / 9 | |
| 32.1.14 | 10 / 9 | |
| 32.1.13 | 10 / 9 | |
| 32.1.11 | 10 / 9 | |
| 32.1.10 | 10 / 9 | |
| 32.1.9 | 10 / 9 | |
| 32.1.8 | 10 / 9 | |
| 32.1.7 | 10 / 9 | |
| 32.1.6 | 10 / 9 | |
| 32.1.5 | 10 / 9 | |
| 32.1.4 | 10 / 9 | |
| 32.1.3 | 10 / 9 | |
| 32.1.2 | 10 / 9 | |
| 32.1.1 | 10 / 9 | |
| 32.1.0 | 10 / 9 | |
| 32.0.0 | 10 / 9 | |
| 31.1.2 | 10 / 8 | |
| 31.1.1 | 10 / 8 | |
| 31.0.0 | 10 / 8 | |
| 29.0.1 | 9 / 7 | |
| 29.0.0 | 9 / 7 | |
| 28.9.0 | 9 / 7 | |
| 28.8.3 | 9 / 7 | |
| 28.8.2 | 9 / 7 | |
| 28.8.1 | 9 / 7 | |
| 28.8.0 | 9 / 7 | |
| 28.7.0 | 9 / 7 | |
| 28.6.3 | 9 / 7 | |
| 28.6.2 | 9 / 7 | |
| 28.6.1 | 9 / 7 | |
| 28.6.0 | 9 / 7 | |
| 28.5.1 | 9 / 7 | |
| 28.5.0 | 9 / 7 | |
| 28.4.0 | 9 / 7 |
v38.1.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v38.0.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v38.0.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v37.2.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v37.1.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v37.0.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.