@adobe-commerce/elsie
Domain Package SDK
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | obfuscated-file:src/shims/importmap.js | AI (source-diff): File is the standard es-module-shims polyfill bundle; minification is expected for this shim. | ai | |
| dependencies | unvetted-dep:@storybook/addon-webpack5-compiler-babel | AI (dependencies): Storybook addon; consistent with SDK build tool purpose. | ai | |
| dependencies | unvetted-dep:@types/preact-i18n | AI (dependencies): TypeScript type definitions; no runtime risk. | ai | |
| dependencies | unvetted-dep:jest-preset-preact | AI (dependencies): Test tooling; consistent with SDK build tool purpose. | ai | |
| dependencies | unvetted-dep:vite-plugin-banner | AI (dependencies): Build plugin; consistent with SDK build tool purpose. | ai | |
| dependencies | unvetted-dep:eslint-config-preact | AI (dependencies): Lint config; consistent with SDK build tool purpose. | ai | |
| dependencies | unvetted-dep:@testing-library/preact | AI (dependencies): Test tooling; consistent with SDK build tool purpose. | ai | |
| dependencies | unvetted-dep:@storybook/addon-coverage | AI (dependencies): Storybook addon; consistent with SDK build tool purpose. | ai | |
| dependencies | unvetted-dep:@storybook/preact-webpack5 | AI (dependencies): Storybook integration; consistent with SDK build tool purpose. | ai | |
| dependencies | unvetted-dep:babel-plugin-tsconfig-paths | AI (dependencies): Babel plugin for build; consistent with SDK build tool purpose. | ai | |
| dependencies | unvetted-dep:graphql-codegen-typescript-mock-data | AI (dependencies): GraphQL codegen tooling; consistent with SDK build tool purpose. | ai | |
| dependencies | unvetted-dep:axe-playwright | AI (dependencies): Dev/test tooling for accessibility testing; consistent with SDK build tool purpose. | ai | |
| dependencies | unvetted-dep:optimize-plugin | AI (dependencies): Build optimization plugin; consistent with SDK build tool purpose. | ai | |
| dependencies | unvetted-dep:@types/css-modules | AI (dependencies): TypeScript type definitions; no runtime risk. | ai | |
| phantom-deps | phantom-dep:storybook | AI (phantom-deps): Storybook tooling declared as dep, referenced in config files — expected for SDK. | ai | |
| phantom-deps | phantom-dep:eslint | AI (phantom-deps): Tooling dep loaded via config; stable FP for this SDK. | ai | |
| phantom-deps | phantom-dep:rimraf | AI (phantom-deps): CLI utility invoked via scripts; stable FP. | ai | |
| phantom-deps | phantom-dep:core-js | AI (phantom-deps): Known implicit runtime dep; stable FP. | ai | |
| phantom-deps | phantom-dep:webpack | AI (phantom-deps): Build tooling loaded via config; stable FP. | ai | |
| phantom-deps | phantom-dep:typescript | AI (phantom-deps): Tooling dep; stable FP for this SDK. | ai | |
| phantom-deps | phantom-dep:jest | AI (phantom-deps): Build tooling declared as dep but loaded via config convention; stable FP for this SDK. | ai | |
| semgrep | semgrep:child-process-import | AI (semgrep): CLI tool that spawns build commands; child_process use is expected and documented. | ai | |
| semgrep | semgrep:dynamic-require | AI (semgrep): Config-loader pattern in bin/lib/config.js; loads user-specified config paths, not arbitrary remote code. | ai |
Versions (showing 6 of 6)
| Version | Deps | Published |
|---|---|---|
| 1.8.1 | 75 / 7 | |
| 1.8.0 | 75 / 7 | |
| 1.7.0 | 75 / 7 | |
| 1.6.0 | 76 / 7 | |
| 1.4.1 | 76 / 7 | |
| 1.2.1 | 74 / 7 |
v1.8.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.7.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.6.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.4.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.2.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.