@aahoughton/oav-core
HTTP-aware OpenAPI request/response validator with a JSON Schema codegen compiler. Zero runtime dependencies; install @aahoughton/oav for the batteries-included experience (YAML readers + CLI).
Supply chain provenance
Status for the latest visible version.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | net-exec-file:dist/chunk-TR7B53OF.cjs | AI (source-diff): Code generation for JSON Schema validation; URL strings are vocabulary identifiers, not network calls. Stable pattern for this package. | ai | |
| source-diff | net-exec-file:dist/chunk-FFJS7MUM.js | AI (source-diff): ESM equivalent of the same codegen pattern; false positive for this schema-compiler package. | ai | |
| source-diff | net-exec-file:dist/chunk-MMIYWQBD.cjs | AI (source-diff): Code generation for JSON Schema validation; ctx.gen.line emits validator code strings, not dynamic eval of remote content. | ai | |
| source-diff | net-exec-file:dist/chunk-YHW6KGRO.js | AI (source-diff): ESM equivalent of the same codegen pattern; no actual network fetch or eval of remote code. | ai | |
| source-diff | net-exec-file:dist/chunk-A57DO7ZQ.cjs | AI (source-diff): Code generation is the library's documented core feature; ctx.gen.line() emits validator code, not malware. | ai | |
| source-diff | net-exec-file:dist/chunk-AYRRKP4K.js | AI (source-diff): Same codegen pattern in ESM chunk; stable false positive for this JSON Schema compiler package. | ai | |
| install-scripts | install-script:preinstall | AI (install-scripts): Standard pnpm-only enforcement guard; only fires inside the monorepo workspace, harmless to downstream consumers. | ai |
Versions (showing 7 of 7)
| Version | Deps | Published |
|---|---|---|
| 2.2.0 | 0 / 9 | |
| 2.1.0 | 0 / 9 | |
| 2.0.0 | 0 / 9 | |
| 1.1.2 | 0 / 9 | |
| 1.1.1 | 0 / 9 | |
| 1.1.0 | 0 / 9 | |
| 1.0.0 | 0 / 9 |
v2.2.0
3 findingsNewly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v2.1.0
3 findingsNewly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v2.0.0
3 findingsNewly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.