schema-utils
webpack Validation Utils
43
Versions
MIT
License
No
Install Scripts
Missing
Provenance
Supply chain provenance
Status for the latest visible version.
No SLSA provenance
npm registry signatures
gitHead linked
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
sokraevilebottnawi
Keywords
webpack
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| dependencies | unvetted-dep:ajv-formats | AI (dependencies): ajv-formats is a well-known, widely-used AJV ecosystem package; its unvetted status is a registry artifact, not a security concern for this package. | ai | |
| dependencies | unvetted-dep:ajv-keywords | AI (dependencies): ajv-keywords is a well-known, widely-used AJV ecosystem package; its unvetted status is a registry artifact, not a security concern for this package. | ai | |
| maintainer-change | maintainer-added | AI (maintainer-change): michael-ciniawsky is an established webpack-contrib contributor; addition is a legitimate maintainer transition, not a compromise. | ai | |
| provenance | publisher-changed | AI (provenance): michael-ciniawsky is a known webpack-contrib maintainer with strong track record; transition from d3viant0ne is a legitimate org handoff within webpack-contrib. | ai | |
| publish-pattern | new-deps-added | AI (publish-pattern): ajv-errors is a legitimate, well-known AJV ecosystem package appropriate for a schema validation utility. | ai | |
| install-scripts | install-script:postinstall | AI (install-scripts): Postinstall script is a documented build step for webpack utilities; uses child_process for legitimate setup tasks, not malicious code execution. | ai | |
| semgrep | semgrep:child-process-import | AI (semgrep): child_process import in postinstall is legitimate for build/setup scripts in webpack ecosystem packages; no evidence of malicious use. | ai | |
| phantom-deps | phantom-dep:@types/json-schema | AI (phantom-deps): @types/json-schema is intentionally listed as a runtime dep in schema-utils to expose TypeScript types to consumers; this is a stable, documented pattern for this package. | ai |
Versions (showing 43 of 43)
| Version | Deps | Published |
|---|---|---|
| 4.3.3 | 4 / 31 | |
| 4.3.2 | 4 / 21 | |
| 4.3.1 | 4 / 21 | |
| 4.3.0 | 4 / 21 | |
| 4.2.0 | 4 / 21 | |
| 4.1.0 | 4 / 21 | |
| 4.0.1 | 4 / 21 | |
| 4.0.0 | 4 / 21 | |
| 3.3.0 | 3 / 21 | |
| 3.2.0 | 3 / 21 | |
| 3.1.2 | 3 / 21 | |
| 3.1.1 | 3 / 21 | |
| 3.1.0 | 3 / 21 | |
| 3.0.0 | 3 / 21 | |
| 2.7.1 | 3 / 21 | |
| 2.7.0 | 3 / 21 | |
| 2.6.6 | 2 / 22 | |
| 2.6.5 | 2 / 24 | |
| 2.6.4 | 2 / 24 | |
| 2.6.3 | 2 / 24 | |
| 2.6.2 | 2 / 24 | |
| 2.6.1 | 2 / 24 | |
| 2.6.0 | 2 / 24 | |
| 2.5.0 | 2 / 23 | |
| 2.4.1 | 2 / 23 | |
| 2.4.0 | 2 / 23 | |
| 2.3.0 | 2 / 22 | |
| 2.2.0 | 2 / 22 | |
| 2.1.0 | 2 / 22 | |
| 2.0.1 | 2 / 22 | |
| 2.0.0 | 2 / 22 | |
| 1.0.0 | 3 / 10 | |
| 0.4.7 | 2 / 10 | |
| 0.4.6 | 2 / 10 | |
| 0.4.5 | 2 / 25 | |
| 0.4.4 | 2 / 25 | |
| 0.4.3 | 2 / 17 | |
| 0.4.2 | 3 / 17 | |
| 0.4.1 | 2 / 16 | |
| 0.4.0 | 2 / 16 | |
| 0.3.0 | 1 / 18 | |
| 0.2.1 | 1 / 21 | |
| 0.1.0 | 1 / 21 |