@adobe/alloy
Adobe Experience Platform Web SDK
8
Versions
Apache-2.0
License
Yes
Install Scripts
Missing
Provenance
Supply chain provenance
Status for the latest visible version.
No SLSA provenance
npm registry signatures
No source commit
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
marbectripodgarthdblazdadobe-adminpatrickfultontrieloffshazronkrisnyedcpfsdknatebaldwindevongovettaspro83symanovidpfisterstefan-guggisbergrofekptdobeadobehallsfullcolorcoderdjaeggidylandepassmhaackamol-anandstopp-adobedotenduh_schmidtasthabh23zdahbituicufmeschbe
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| phantom-deps | phantom-dep:@adobe/reactor-query-string | AI (phantom-deps): Same-org Adobe dep; consumed via bundled build rather than direct import. | ai | |
| phantom-deps | phantom-dep:js-cookie | AI (phantom-deps): Declared runtime dep used in bundled output; phantom-dep heuristic fires because it's not directly imported at top level. | ai | |
| phantom-deps | phantom-dep:@adobe/aep-rules-engine | AI (phantom-deps): Same-org Adobe dep; likely consumed via bundled build rather than direct import. | ai | |
| publish-pattern | new-deps-added | AI (publish-pattern): @rollup/plugin-replace is a well-established Rollup plugin; addition is part of documented Babel-to-Rollup migration. | ai | |
| provenance | no-provenance | AI (provenance): Established Adobe package; lack of Sigstore provenance is common and not a risk signal here. | ai | |
| phantom-deps | phantom-dep:@adobe/reactor-object-assign | AI (phantom-deps): Same-org Adobe reactor package; loaded by convention in build pipeline. | ai | |
| semgrep | semgrep:dynamic-require | AI (semgrep): Fires in versionBabelPlugin.js to read own package.json version; not a runtime code-loading risk. | ai | |
| phantom-deps | phantom-dep:@adobe/reactor-cookie | AI (phantom-deps): Same-org Adobe reactor package; loaded by convention in build pipeline. | ai | |
| phantom-deps | phantom-dep:@adobe/reactor-load-script | AI (phantom-deps): Same-org Adobe reactor package; loaded by convention in build pipeline. | ai | |
| phantom-deps | phantom-dep:css.escape | AI (phantom-deps): Referenced in config files; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:@babel/preset-env | AI (phantom-deps): Babel preset loaded by convention via babel.config.js, not directly imported; stable false positive for this build toolchain. | ai | |
| phantom-deps | phantom-dep:@babel/plugin-transform-template-literals | AI (phantom-deps): Babel plugin loaded by convention; stable false positive for this build toolchain. | ai | |
| phantom-deps | phantom-dep:@babel/plugin-transform-modules-commonjs | AI (phantom-deps): Babel plugin loaded by convention; stable false positive for this build toolchain. | ai |