promptfoo
Supply chain provenance
Status for the latest visible version.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| semgrep | semgrep:child-process-import | AI (semgrep): Python assertion execution feature; intrinsic to tool's eval functionality. | ai | |
| semgrep | semgrep:dynamic-require | AI (semgrep): Loads user-specified local config file by extension; standard CLI pattern. | ai | |
| semgrep | semgrep:new-function-constructor | AI (semgrep): Documented custom-eval assertion feature, expected user-controlled code execution. | ai | |
| source-diff | net-exec-file:dist/src/aws-DXcdBGfv.cjs | AI (source-diff): Bundled AWS Bedrock provider; network+require is core to the tool's provider integrations. | ai | |
| source-diff | net-exec-file:dist/src/providers-lmV8J0jR.cjs | AI (source-diff): Bundled providers module; net+exec inherent to eval provider integrations. | ai | |
| source-diff | obfuscated-file:dist/src/providers-lmV8J0jR.cjs | AI (source-diff): Minified bundler output, not true obfuscation; matches package build. | ai | |
| source-diff | obfuscated-file:dist/src/providers-DtkVivDo.cjs | AI (source-diff): tsdown-minified provider bundle; long lines are build output not obfuscation. | ai | |
| source-diff | net-exec-file:dist/src/providers-DtkVivDo.cjs | AI (source-diff): Bundled provider module; network+exec expected for an LLM provider layer. | ai | |
| source-diff | net-exec-file:dist/src/app/assets/index-FpA-mwjL.js | AI (source-diff): Bundled front-end app code; benign fetch/render, not a loader. | ai | |
| source-diff | net-exec-file:dist/src/app/assets/vendor-mui-x-B3p8MQbf.js | AI (source-diff): MUI-X vendor bundle; standard UI code. | ai | |
| source-diff | obfuscated-file:dist/src/app/assets/source-map-support-C99j8ebS.js | AI (source-diff): Minified source-map-support vendor bundle. | ai | |
| source-diff | obfuscated-file:dist/src/app/assets/index-FpA-mwjL.js | AI (source-diff): Vite-bundled SPA asset; minified not obfuscated. | ai | |
| source-diff | net-exec-file:dist/src/providers-CgKOSgTR.cjs | AI (source-diff): Provider bundle legitimately makes network calls to LLM APIs; benign for this package. | ai | |
| source-diff | obfuscated-file:dist/src/providers-CgKOSgTR.cjs | AI (source-diff): Minified bundler output (long lines), not true obfuscation; stable across releases. | ai | |
| source-diff | obfuscated-file:dist/src/providers-CpUrPa8s.cjs | AI (source-diff): tsdown-minified build output, long lines are bundling not obfuscation. | ai | |
| source-diff | net-exec-file:dist/src/providers-CpUrPa8s.cjs | AI (source-diff): Bundled providers module; net+exec expected for provider integrations. | ai | |
| source-diff | net-exec-file:dist/src/providers-DHbjzW2e.cjs | AI (source-diff): Bundled provider module; long lines are build minification. | ai | |
| source-diff | obfuscated-file:dist/src/providers-DHbjzW2e.cjs | AI (source-diff): Minified tsdown build output, not obfuscation. | ai | |
| source-diff | net-exec-file:dist/src/providers-BtzUfbxZ.cjs | AI (source-diff): Bundled provider module; net+exec expected for eval provider execution. | ai | |
| source-diff | obfuscated-file:dist/src/providers-BtzUfbxZ.cjs | AI (source-diff): Minified tsdown bundle, not obfuscation; long lines are build artifacts. | ai | |
| source-diff | obfuscated-file:dist/src/app/assets/source-map-support-CEw_IGAd.js | AI (source-diff): Minified source-map-support vendor bundle. | ai | |
| source-diff | net-exec-file:dist/src/app/assets/index-DcG0DpZ5.js | AI (source-diff): Bundled browser app; net+exec are normal SPA patterns, no hostile target. | ai | |
| source-diff | obfuscated-file:dist/src/app/assets/index-DcG0DpZ5.js | AI (source-diff): Vite-bundled React frontend asset; minified build output, not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/src/providers-D3WAfYou.cjs | AI (source-diff): Minified bundler output, not true obfuscation; stable for this build pipeline. | ai | |
| source-diff | net-exec-file:dist/src/providers-D3WAfYou.cjs | AI (source-diff): Provider bundle legitimately makes network + exec calls; core function of the tool. | ai | |
| source-diff | net-exec-file:dist/src/providers-4g9A4cGL.cjs | AI (source-diff): Bundled provider module; minified build output, no true obfuscation signature. | ai | |
| source-diff | obfuscated-file:dist/src/providers-4g9A4cGL.cjs | AI (source-diff): tsdown-minified dist, long lines are build output not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/src/providers-BMeR_hLP.cjs | AI (source-diff): Minified bundler output, not obfuscation; stable for this build pipeline. | ai | |
| source-diff | net-exec-file:dist/src/providers-BMeR_hLP.cjs | AI (source-diff): Bundled provider module; network+exec are core to LLM provider integrations. | ai | |
| source-diff | obfuscated-file:dist/src/app/assets/source-map-support-CVIuR1ht.js | AI (source-diff): Minified source-map-support vendor chunk. | ai | |
| source-diff | net-exec-file:dist/src/app/assets/index-CXp6Lh_8.js | AI (source-diff): Bundled React/MUI app chunk; network+eval patterns are library code, not a dropper. | ai | |
| source-diff | obfuscated-file:dist/src/app/assets/index-CXp6Lh_8.js | AI (source-diff): Vite-bundled frontend chunk; minified build output, regenerated each release. | ai | |
| source-diff | obfuscated-file:dist/src/app/assets/source-map-support-CQ-TY82X.js | AI (source-diff): Bundled source-map-support lib; minified vendor code. | ai | |
| source-diff | obfuscated-file:dist/src/app/assets/index-C5kuLdph.js | AI (source-diff): Vite-bundled SPA asset; minified build output, regenerated each release. | ai | |
| source-diff | net-exec-file:dist/src/app/assets/index-C5kuLdph.js | AI (source-diff): Bundled React app runtime, not a loader; benign for this package. | ai | |
| source-diff | net-exec-file:dist/src/app/assets/index-DvnJzB2w.js | AI (source-diff): Webapp bundle with normal fetch/dynamic-import; not a dropper. | ai | |
| source-diff | obfuscated-file:dist/src/app/assets/source-map-support-BmvzFAhR.js | AI (source-diff): Minified source-map-support vendor bundle. | ai | |
| source-diff | obfuscated-file:dist/src/app/assets/index-DvnJzB2w.js | AI (source-diff): Vite-bundled frontend asset; minified build output, regenerates each release. | ai | |
| source-diff | net-exec-file:dist/src/app/assets/vendor-mui-x-vA4qspBa.js | AI (source-diff): MUI-X vendor bundle; benign minified build output. | ai | |
| source-diff | obfuscated-file:dist/src/providers-DmCBX83O.cjs | AI (source-diff): Minified tsdown bundle output, not obfuscation; regenerated per release. | ai | |
| source-diff | net-exec-file:dist/src/providers-DmCBX83O.cjs | AI (source-diff): Provider bundle legitimately makes network+exec calls; build artifact. | ai | |
| source-diff | obfuscated-file:dist/src/app/assets/source-map-support-1v4oeb7P.js | AI (source-diff): Bundled source-map-support vendor chunk, minified build output. | ai | |
| source-diff | obfuscated-file:dist/src/app/assets/index-eJ2lMe94.js | AI (source-diff): Vite-bundled web UI output, minified not obfuscated. | ai | |
| source-diff | net-exec-file:dist/src/app/assets/index-eJ2lMe94.js | AI (source-diff): Bundled SPA with fetch+dynamic import; benign vite build artifact. | ai | |
| source-diff | net-exec-file:dist/src/providers-CFAJHysk.cjs | AI (source-diff): Bundled provider module; network+exec expected for LLM provider integrations. | ai | |
| source-diff | obfuscated-file:dist/src/providers-BNk2AdyA.cjs | AI (source-diff): tsdown/rollup minified bundle, not obfuscation; stable build output. | ai | |
| source-diff | net-exec-file:dist/src/providers-BNk2AdyA.cjs | AI (source-diff): Bundled provider module; network+exec inherent to provider integrations. | ai | |
| source-diff | net-exec-file:dist/src/app/assets/index-CDCJWS66.js | AI (source-diff): Bundled React app entry; import/fetch machinery, no hostile target. | ai | |
| source-diff | obfuscated-file:dist/src/app/assets/source-map-support-BPdSsBdq.js | AI (source-diff): Bundled source-map-support base64 VLQ codec; benign minified vendor code. | ai | |
| source-diff | net-exec-file:dist/src/app/assets/vendor-mui-x-B285qkCy.js | AI (source-diff): Bundled MUI-X DataGrid vendor chunk; benign build output. | ai | |
| source-diff | obfuscated-file:dist/src/app/assets/index-CDCJWS66.js | AI (source-diff): Vite-bundled web UI asset; minified not obfuscated, stable per release. | ai | |
| source-diff | net-exec-file:dist/src/providers-CS54SV62.cjs | AI (source-diff): Bundled provider modules calling LLM APIs; expected behavior. | ai | |
| source-diff | obfuscated-file:dist/src/data-DF-FvXLM.cjs | AI (source-diff): Bundled redteam prompt-injection dataset, long lines are JSON strings; stable for this package. | ai | |
| source-diff | obfuscated-file:dist/src/providers-BNKVY53V.cjs | AI (source-diff): tsdown-minified provider bundle, not true obfuscation. | ai | |
| source-diff | net-exec-file:dist/src/providers-BNKVY53V.cjs | AI (source-diff): Bundled provider module; network calls are the package's core function. | ai | |
| source-diff | net-exec-file:dist/src/providers-CFu-TZl-.cjs | AI (source-diff): Bundled provider module; network+exec expected for provider execution. | ai | |
| source-diff | obfuscated-file:dist/src/providers-CFu-TZl-.cjs | AI (source-diff): Minified tsdown build output, not obfuscation; stable for this package's dist. | ai | |
| source-diff | net-exec-file:dist/src/providers-BWoVY_Wz.cjs | AI (source-diff): Bundled providers module; network+exec inherent to LLM provider integrations. | ai | |
| source-diff | obfuscated-file:dist/src/providers-BWoVY_Wz.cjs | AI (source-diff): Bundled/minified provider output, not true obfuscation. | ai | |
| source-diff | net-exec-file:dist/src/providers-WnAfnzLf.cjs | AI (source-diff): Bundled provider module of an LLM eval toolkit; network calls to LLM APIs are its core function. | ai | |
| source-diff | obfuscated-file:dist/src/providers-CScd1wN6.cjs | AI (source-diff): tsdown-minified build output, not obfuscation. | ai | |
| source-diff | net-exec-file:dist/src/providers-CScd1wN6.cjs | AI (source-diff): Bundled provider module; network calls are the package's stated function. | ai | |
| source-diff | obfuscated-file:dist/src/providers-BF4aullZ.cjs | AI (source-diff): Minified bundler output, not true obfuscation. | ai | |
| source-diff | net-exec-file:dist/src/providers-BF4aullZ.cjs | AI (source-diff): Bundled providers module; network+exec is inherent to an LLM-provider toolkit. | ai | |
| source-diff | net-exec-file:dist/src/app/assets/index-DifT6VGT.js | AI (source-diff): Bundled React app chunk; net+exec is normal SPA runtime, no hostile destination. | ai | |
| source-diff | obfuscated-file:dist/src/app/assets/source-map-support-Bnh0UQ2S.js | AI (source-diff): Bundled source-map-support library; minified vite chunk. | ai | |
| source-diff | net-exec-file:dist/src/app/assets/vendor-mui-x-C2xF-yiO.js | AI (source-diff): Bundled MUI-X vendor chunk; icon/component code, benign build output. | ai | |
| source-diff | obfuscated-file:dist/src/app/assets/index-DifT6VGT.js | AI (source-diff): Vite-bundled web UI output with visible bundler banner; minified not obfuscated. | ai | |
| source-diff | net-exec-file:dist/src/app/assets/vendor-mui-x-C0Zq2q0Y.js | AI (source-diff): Bundled MUI-X vendor chunk; benign build output. | ai | |
| source-diff | net-exec-file:dist/src/app/assets/index-Dn6NT1A2.js | AI (source-diff): Bundled React app entry; net+exec are framework code, not a dropper. | ai | |
| source-diff | obfuscated-file:dist/src/app/assets/index-Dn6NT1A2.js | AI (source-diff): Vite-bundled web-app entry; minified build output, not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/src/app/assets/source-map-support-XzfnsDIg.js | AI (source-diff): Minified source-map-support vendor bundle. | ai | |
| install-scripts | install-script:postinstall | AI (install-scripts): Guarded hooks:install runs only in a .git checkout; no-op for consumers. | ai | |
| source-diff | obfuscated-file:dist/src/providers-Bz0U4NGd.cjs | AI (source-diff): Minified tsdown build output, not obfuscation; stable for this bundled package. | ai | |
| source-diff | obfuscated-file:dist/src/providers-Ce2-tX4F.cjs | AI (source-diff): Minified tsdown bundle output, not obfuscation. | ai | |
| source-diff | net-exec-file:dist/src/providers-Ce2-tX4F.cjs | AI (source-diff): Bundled provider registry; network+exec expected in an LLM eval tool. | ai | |
| source-diff | net-exec-file:dist/src/providers-DEJW_Mce.cjs | AI (source-diff): Bundled provider module; network+exec are core to the LLM provider layer. | ai | |
| source-diff | obfuscated-file:dist/src/providers-DEJW_Mce.cjs | AI (source-diff): tsdown-minified provider bundle; long lines are build output, no obfuscation signature. | ai | |
| source-diff | net-exec-file:dist/src/providers-D1lUSO6m.cjs | AI (source-diff): Bundled providers module; network+exec expected for an LLM provider toolkit. | ai | |
| source-diff | obfuscated-file:dist/src/providers-D1lUSO6m.cjs | AI (source-diff): Minified tsdown bundle, long lines are build output not obfuscation. | ai | |
| source-diff | net-exec-file:dist/src/providers-BuFfPRsl.cjs | AI (source-diff): Bundled provider module; network+exec expected for LLM eval tool. | ai | |
| source-diff | obfuscated-file:dist/src/providers-BuFfPRsl.cjs | AI (source-diff): Minified bundler output, not obfuscation; stable for this build pipeline. | ai | |
| source-diff | net-exec-file:dist/src/providers-CbcT30KA.cjs | AI (source-diff): Provider bundle; network+exec expected for LLM provider dispatch. | ai | |
| source-diff | obfuscated-file:dist/src/providers-CbcT30KA.cjs | AI (source-diff): tsdown bundle output (long lines), not true obfuscation. | ai | |
| source-diff | obfuscated-file:dist/src/providers-7NldzwUW.cjs | AI (source-diff): Minified bundler output, not obfuscation; recurs every build. | ai | |
| source-diff | net-exec-file:dist/src/providers-7NldzwUW.cjs | AI (source-diff): Bundled providers module; network+exec expected for LLM provider integrations. | ai | |
| source-diff | obfuscated-file:dist/src/providers-Bp36xEIQ.cjs | AI (source-diff): tsdown-bundled minified provider module, not true obfuscation. | ai | |
| source-diff | net-exec-file:dist/src/providers-Bp36xEIQ.cjs | AI (source-diff): Bundled provider module; network+exec are core to an LLM eval tool. | ai | |
| source-diff | obfuscated-file:dist/src/providers-CvAgCuKp.cjs | AI (source-diff): Minified tsdown bundle, not obfuscation; long lines are build output. | ai | |
| source-diff | net-exec-file:dist/src/providers-CvAgCuKp.cjs | AI (source-diff): Bundled provider module; network+exec inherent to a multi-provider LLM tool. | ai | |
| source-diff | net-exec-file:dist/src/app/assets/index-DTy7aidn.js | AI (source-diff): Bundled frontend SPA; net+exec is normal minified React app code. | ai | |
| source-diff | obfuscated-file:dist/src/app/assets/index-DTy7aidn.js | AI (source-diff): Vite-bundled minified webapp asset, not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/src/app/assets/source-map-support-BiIeb3Ol.js | AI (source-diff): Minified source-map-support lib in Vite bundle. | ai | |
| source-diff | net-exec-file:dist/src/app/assets/vendor-mui-x-BZ0aDIR1.js | AI (source-diff): Bundled MUI-X vendor chunk; benign minified output. | ai | |
| source-diff | net-exec-file:dist/src/providers-CHa3rbfZ.cjs | AI (source-diff): Bundled providers module; net+exec expected for provider integrations. | ai | |
| source-diff | obfuscated-file:dist/src/providers-CHa3rbfZ.cjs | AI (source-diff): Minified/bundled build output, not true obfuscation. | ai | |
| npm-metadata | url-dep:rouge | AI (npm-metadata): Long-standing immutably SHA-pinned ROUGE metric lib; unchanged across versions. | ai | |
| source-diff | obfuscated-file:dist/src/providers-DQ428u-U.cjs | AI (source-diff): Minified tsdown bundle output, not obfuscation; long lines are build artifacts. | ai | |
| source-diff | net-exec-file:dist/src/providers-DQ428u-U.cjs | AI (source-diff): Bundled provider module; network+exec inherent to provider integrations. | ai | |
| source-diff | net-exec-file:dist/src/index.cjs | AI (source-diff): Bundled dist entrypoint of a build tool; net+exec is expected for an LLM eval CLI. | ai | |
| source-diff | obfuscated-file:dist/src/app/assets/index-iyBP4nBI.js | AI (source-diff): Vite-bundled web UI, minified not obfuscated; recurs every release. | ai | |
| source-diff | obfuscated-file:dist/src/app/assets/source-map-support-CSFI39ks.js | AI (source-diff): Minified source-map-support library, benign bundle chunk. | ai | |
| source-diff | net-exec-file:dist/src/app/assets/index-iyBP4nBI.js | AI (source-diff): Bundled React app; network+exec patterns are normal SPA build output. | ai | |
| dependencies | unvetted-dep:rouge | AI (dependencies): rouge is a well-known NLP scoring lib used for eval metrics, fits stated purpose. | ai | |
| bogus-package | bogus-package | AI (bogus-package): Mature legitimate package; README/keyword heuristics are false positives here. | ai | |
| source-diff | net-exec-file:dist/src/aws-Dao2vq-8.cjs | AI (source-diff): Rolldown-bundled Bedrock provider; network+require are legit AWS/AI SDK usage, not a loader. | ai | |
| source-diff | net-exec-file:dist/src/aws-DZ0G882T.cjs | AI (source-diff): Bundled AWS Bedrock provider; network+exec is inherent to this LLM eval tool's purpose. | ai | |
| source-diff | net-exec-file:dist/src/aws-D54hswwK.cjs | AI (source-diff): Bundled AWS Bedrock provider; network+exec pattern is inherent to LLM provider SDK wrappers. | ai | |
| source-diff | net-exec-file:dist/src/aws-B6z7Bp-y.cjs | AI (source-diff): Bundled AWS Bedrock provider; network+exec is inherent to an LLM eval toolkit calling cloud APIs. | ai | |
| source-diff | net-exec-file:dist/src/evalResult-BgL2HNJC.cjs | AI (source-diff): Rolldown-bundled CJS chunk; network+require pattern is normal for bundled output. | ai | |
| source-diff | large-new-source-files | AI (source-diff): Bundler migration (rolldown) causes chunk filename churn; stable pattern for this package. | ai | |
| source-diff | net-exec-file:dist/src/aws-CcirYqo_.cjs | AI (source-diff): Rolldown-bundled CJS chunk for AWS Bedrock provider; network+require pattern is normal for this package. | ai | |
| phantom-deps | phantom-dep:gcp-metadata | AI (phantom-deps): Referenced in config/override context; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:@opentelemetry/sdk-trace-base | AI (phantom-deps): OTel SDK loaded via plugin pattern; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:@opencode-ai/sdk | AI (phantom-deps): Optional provider integration; loaded by convention, not direct import. | ai | |
| phantom-deps | phantom-dep:@types/ws | AI (phantom-deps): Type-only dep; used as framework-scoped type declaration, not a direct import. | ai |
Versions (showing 100 of 208)
| Version | Deps | Published |
|---|---|---|
| 0.49.1 | 36 / 28 | |
| 0.49.0 | 36 / 28 | |
| 0.48.0 | 36 / 28 | |
| 0.47.0 | 34 / 26 | |
| 0.46.0 | 34 / 26 | |
| 0.45.2 | 34 / 26 | |
| 0.45.1 | 34 / 26 | |
| 0.45.0 | 34 / 26 | |
| 0.44.0 | 34 / 26 | |
| 0.43.1 | 34 / 26 | |
| 0.43.0 | 34 / 26 | |
| 0.42.0 | 34 / 26 | |
| 0.41.0 | 34 / 26 | |
| 0.40.0 | 34 / 26 | |
| 0.39.1 | 34 / 26 | |
| 0.39.0 | 34 / 26 | |
| 0.38.0 | 33 / 26 | |
| 0.37.1 | 32 / 26 | |
| 0.37.0 | 32 / 26 | |
| 0.36.0 | 32 / 26 | |
| 0.35.1 | 32 / 26 | |
| 0.35.0 | 32 / 25 | |
| 0.34.1 | 32 / 25 | |
| 0.34.0 | 32 / 25 | |
| 0.33.3 | 32 / 25 | |
| 0.33.2 | 32 / 25 | |
| 0.33.1 | 32 / 25 | |
| 0.33.0 | 32 / 25 | |
| 0.32.0 | 32 / 25 | |
| 0.31.2 | 32 / 25 | |
| 0.31.1 | 32 / 25 | |
| 0.31.0 | 32 / 25 | |
| 0.30.2 | 31 / 25 | |
| 0.30.1 | 31 / 25 | |
| 0.30.0 | 31 / 25 | |
| 0.29.0 | 31 / 25 | |
| 0.28.2 | 30 / 24 | |
| 0.28.1 | 30 / 24 | |
| 0.28.0 | 30 / 24 | |
| 0.27.1 | 29 / 24 | |
| 0.27.0 | 29 / 24 | |
| 0.26.5 | 29 / 24 | |
| 0.26.3 | 29 / 24 | |
| 0.26.2 | 29 / 24 | |
| 0.26.1 | 29 / 24 | |
| 0.26.0 | 29 / 24 | |
| 0.25.2 | 29 / 24 | |
| 0.25.1 | 29 / 24 | |
| 0.25.0 | 29 / 24 | |
| 0.24.4 | 29 / 24 | |
| 0.24.3 | 29 / 24 | |
| 0.24.2 | 29 / 24 | |
| 0.24.1 | 29 / 24 | |
| 0.24.0 | 29 / 24 | |
| 0.23.1 | 29 / 24 | |
| 0.23.0 | 29 / 24 | |
| 0.22.0 | 29 / 24 | |
| 0.21.4 | 29 / 24 | |
| 0.21.3 | 29 / 24 | |
| 0.21.2 | 29 / 24 | |
| 0.21.1 | 29 / 24 | |
| 0.21.0 | 29 / 24 | |
| 0.20.1 | 29 / 23 | |
| 0.20.0 | 29 / 23 | |
| 0.19.3 | 28 / 23 | |
| 0.19.2 | 28 / 23 | |
| 0.19.1 | 27 / 23 | |
| 0.19.0 | 27 / 23 | |
| 0.18.4 | 25 / 21 | |
| 0.18.3 | 25 / 21 | |
| 0.18.2 | 25 / 21 | |
| 0.18.1 | 25 / 21 | |
| 0.18.0 | 25 / 21 | |
| 0.17.9 | 25 / 21 | |
| 0.17.8 | 25 / 21 | |
| 0.17.7 | 25 / 21 | |
| 0.17.6 | 25 / 21 | |
| 0.17.5 | 24 / 21 | |
| 0.17.4 | 24 / 21 | |
| 0.17.3 | 24 / 21 | |
| 0.17.2 | 23 / 21 | |
| 0.17.1 | 23 / 21 | |
| 0.17.0 | 23 / 21 | |
| 0.16.0 | 23 / 21 | |
| 0.15.0 | 23 / 21 | |
| 0.14.2 | 23 / 21 | |
| 0.14.1 | 23 / 21 | |
| 0.14.0 | 23 / 21 | |
| 0.13.1 | 23 / 21 | |
| 0.13.0 | 23 / 21 | |
| 0.12.0 | 23 / 21 | |
| 0.11.0 | 22 / 20 | |
| 0.10.0 | 20 / 20 | |
| 0.9.0 | 20 / 20 | |
| 0.8.3 | 20 / 18 | |
| 0.8.2 | 20 / 18 | |
| 0.8.1 | 20 / 18 | |
| 0.8.0 | 20 / 18 | |
| 0.7.0 | 19 / 18 | |
| 0.6.0 | 18 / 17 |
v0.49.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.49.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.48.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.47.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.46.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.45.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.45.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.45.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.44.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.43.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.43.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.42.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.41.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.40.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.39.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.39.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.38.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.37.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.37.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.36.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.35.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.35.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.34.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.34.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.33.3
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.33.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.33.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.33.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.32.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.31.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.31.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.31.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.30.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.30.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.30.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.29.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.28.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.28.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.28.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.27.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.27.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.26.5
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.26.3
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.26.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.26.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.26.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.25.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.25.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.25.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.24.4
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.24.3
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.24.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.24.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.24.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.23.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.23.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.22.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.21.4
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.21.3
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.21.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.21.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.21.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.20.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.20.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.19.3
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.19.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.19.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.19.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.18.4
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.18.3
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.18.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.18.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.18.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.17.9
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.17.8
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.17.7
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.17.6
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.17.5
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.17.4
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.17.3
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.17.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.17.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.17.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.16.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.15.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.14.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.14.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.14.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.13.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.13.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.12.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.11.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.10.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.9.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.8.3
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.8.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.8.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.8.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.7.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.6.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.