@aptre/common — Greenflagged

Common project configuration files and dependencies.

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures gitHead linked

paralin

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
phantom-deps	phantom-dep:eslint-config-prettier	AI (phantom-deps): Config/tooling dependency; stable pattern for this shared-config package.	ai	2026/05/27
phantom-deps	phantom-dep:eslint-plugin-unused-imports	AI (phantom-deps): Config/tooling dependency; stable pattern for this shared-config package.	ai	2026/05/27
phantom-deps	phantom-dep:@typescript-eslint/eslint-plugin	AI (phantom-deps): Config/tooling dependency; stable pattern for this shared-config package.	ai	2026/05/27
phantom-deps	phantom-dep:starpc	AI (phantom-deps): Config/tooling dependency; stable pattern for this shared-config package.	ai	2026/05/27
phantom-deps	phantom-dep:eslint-plugin-react-hooks	AI (phantom-deps): Config/tooling dependency; stable pattern for this shared-config package.	ai	2026/05/27
phantom-deps	phantom-dep:@typescript-eslint/parser	AI (phantom-deps): Same rationale as eslint — referenced in shared config files, not directly imported in TS source.	ai	2026/04/28
phantom-deps	phantom-dep:eslint	AI (phantom-deps): This package ships shared eslint config; eslint is a runtime dep for consumers, not directly imported in source.	ai	2026/04/28

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.