BEACON

← candidates

npm @ui5/create-webcomponents-package @2.24.2

score
0.7333 high
flagged 2026-07-24 07:27
signals by category
content 1 topology 2

maintainers added: —

package profile →

Signals fired

signalweightrationale
content
provenance_dropped 0.8 prior version published with SLSA attestation; current version has none
topology
dist_tag_anomaly 0.5 dist-tags.latest=2.24.2 but max published is 2.25.0-rc.0
shared_repo_different_publisher 0.9 repo 'git+https://github.com/UI5/webcomponents.git' also claimed by 10 package(s) under different publishers: ['npm/@ui5/webcomponents-tools', 'npm/@ui5/webcomponents', 'npm/@ui5/webcomponents-ai'] ...

Prior profile (what it deviated from)

{
  "had_install_script": false,
  "maintainers": [
    "sap-ospo-admin",
    "ui5-bot"
  ],
  "versions": 541
}

Evidence (package doc at flag time)

{
  "dependencies_count": 4,
  "dist": {
    "integrity": "sha512-hMO8DaHumNdt0IhdzmbplpipCk/vZOF8/sNTOAJ32EIpExILQSrbEPqwhvsLFVhKyhOxNn6oMqyeJsHvkPusnA==",
    "tarball": "https://registry.npmjs.org/@ui5/create-webcomponents-package/-/create-webcomponents-package-2.24.2.tgz",
    "unpackedSize": 123575
  },
  "dist-tags": {
    "experimental": "0.0.0-10f3c0dc7",
    "hotfix-2.10": "2.10.1",
    "hotfix-2.13": "2.13.8",
    "hotfix-2.14": "2.14.1",
    "hotfix-2.15": "2.15.5",
    "hotfix-2.16": "2.16.3",
    "hotfix-2.17": "2.17.2",
    "hotfix-2.18": "2.18.2",
    "hotfix-2.19": "2.19.4",
    "hotfix-2.20": "2.20.5",
    "hotfix-2.21": "2.21.2",
    "hotfix-2.22": "2.22.1",
    "hotfix-2.23": "2.23.3",
    "latest": "2.24.2",
    "next": "2.25.0-rc.3",
    "sf": "2.4.2",
    "v1": "1.24.29"
  },
  "latest_version": "2.24.2",
  "maintainers": [
    {
      "email": "ospo@sap.com",
      "name": "sap-ospo-admin"
    },
    {
      "email": "ui5-bot+npm-ui5-bot@sap.com",
      "name": "ui5-bot"
    }
  ],
  "num_versions": 542,
  "repository": {
    "directory": "packages/create-package",
    "type": "git",
    "url": "git+https://github.com/UI5/webcomponents.git"
  },
  "scripts": null,
  "signal_details": {
    "dist_tag_anomaly": "dist-tags.latest=2.24.2 but max published is 2.25.0-rc.0",
    "provenance_dropped": "prior version published with SLSA attestation; current version has none",
    "shared_repo_different_publisher": "repo 'git+https://github.com/UI5/webcomponents.git' also claimed by 10 package(s) under different publishers: ['npm/@ui5/webcomponents-tools', 'npm/@ui5/webcomponents', 'npm/@ui5/webcomponents-ai'] ..."
  },
  "time": {
    "created": "2021-10-07T11:11:02.518Z",
    "modified": "2026-07-24T12:27:07.635Z"
  }
}