redux-saga
Saga middleware for Redux to handle Side Effects
Supply chain provenance
Status for the latest visible version.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | obfuscated-file:dist/io-7d23caab.js | AI (source-diff): Rollup/terser minified build output of package's own runtime, not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/io-1d900520.js | AI (source-diff): Terser-minified build output, not obfuscation; stable for this build pipeline. | ai | |
| source-diff | obfuscated-file:dist/io-3ad0e761.js | AI (source-diff): Terser-minified rollup build output, not obfuscation; stable for this package. | ai | |
| source-diff | obfuscated-file:dist/io-d47abd80.js | AI (source-diff): Terser-minified rollup dist output; long lines are build artifact, not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/io-b13d5dfb.js | AI (source-diff): Minified rollup/terser build output of saga core, not obfuscation. | ai | |
| source-diff | net-exec-file-transition:dist/redux-saga-core.esmodules-browsers.js | AI (source-diff): Rollup-bundled dist of a canonical library; net+exec pattern is build output, not malicious behavior. | ai | |
| provenance | missing-githead | AI (provenance): Established package/publisher; gitHead absence is metadata noise, not malicious behavior. | ai | |
| phantom-deps | phantom-dep:@babel/runtime | AI (phantom-deps): @babel/runtime is injected by @babel/plugin-transform-runtime, not directly imported. | ai | |
| maintainer-change | maintainer-removed | AI (maintainer-change): Bot account replaced by GitHub Actions CI; expected during CI migration. | ai | |
| provenance | publisher-changed | AI (provenance): Migrated to GitHub Actions CI/CD with SLSA provenance; legitimate transition for this package. | ai | |
| bogus-package | bogus-package | AI (bogus-package): redux-saga is a 10+ year old package with 1.5M weekly downloads; bogus-package signals are false positives from wrapper package structure. | ai | |
| dependencies | unvetted-dep:@redux-saga/core | AI (dependencies): redux-saga is intentionally a thin proxy package for @redux-saga/core — this is the project's documented split-package architecture, stable across all versions. | ai | |
| provenance | no-provenance | AI (provenance): Established package with 1.5M weekly downloads and 3,800+ day history; lack of provenance attestation is not a meaningful risk signal here. | ai |
Versions (showing 21 of 21)
| Version | Deps | Published |
|---|---|---|
| 1.5.1 | 2 / 4 | |
| 1.5.0 | 2 / 4 | |
| 1.4.3 | 2 / 4 | |
| 1.4.2 | 1 / 4 | |
| 1.4.1 | 1 / 4 | |
| 1.4.0 | 1 / 4 | |
| 1.3.0 | 1 / 12 | |
| 1.2.3 | 1 / 12 | |
| 1.2.2 | 1 / 12 | |
| 1.2.1 | 1 / 12 | |
| 1.2.0 | 1 / 12 | |
| 1.1.3 | 1 / 13 | |
| 1.1.2 | 1 / 13 | |
| 1.1.1 | 1 / 14 | |
| 1.1.0 | 1 / 14 | |
| 1.0.5 | 1 / 14 | |
| 1.0.4 | 1 / 14 | |
| 1.0.3 | 1 / 14 | |
| 1.0.2 | 1 / 14 | |
| 1.0.1 | 1 / 14 | |
| 1.0.0 | 1 / 14 |
v1.5.1
2 findingsPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
[Accepted risk] This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: GitHub Actions.
v1.3.0
2 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.2.3
2 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.2.2
2 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.2.0
4 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
This file did not combine network calls with dynamic code execution in the previously greenflagged version, and now does. Gaining both halves in an existing file is a hallmark of a dropper/loader introduced by an update.
This version was published by a different npm account (redux-saga-release-bot) than the most recent previously approved version (andarist) on 2022-08-13. It has since remained available on npm for 1436 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.1.3
3 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
This file did not combine network calls with dynamic code execution in the previously greenflagged version, and now does. Gaining both halves in an existing file is a hallmark of a dropper/loader introduced by an update.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.1.2
3 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
This file did not combine network calls with dynamic code execution in the previously greenflagged version, and now does. Gaining both halves in an existing file is a hallmark of a dropper/loader introduced by an update.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.1.1
3 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
This file did not combine network calls with dynamic code execution in the previously greenflagged version, and now does. Gaining both halves in an existing file is a hallmark of a dropper/loader introduced by an update.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.1.0
3 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
This file did not combine network calls with dynamic code execution in the previously greenflagged version, and now does. Gaining both halves in an existing file is a hallmark of a dropper/loader introduced by an update.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.5
2 findingsThis file did not combine network calls with dynamic code execution in the previously greenflagged version, and now does. Gaining both halves in an existing file is a hallmark of a dropper/loader introduced by an update.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.4
2 findingsThis file did not combine network calls with dynamic code execution in the previously greenflagged version, and now does. Gaining both halves in an existing file is a hallmark of a dropper/loader introduced by an update.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.2
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: andarist.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.