@atomicservice/ascf-toolkit
ASCF toolkit for atomicservice
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| semgrep | semgrep:shady-links-raw-ip | AI (semgrep): HDC device executor communicates with local device IPs; expected for this toolkit. | ai | |
| semgrep | semgrep:hex-decode | AI (semgrep): Signing/crypto tooling legitimately uses hex encoding; no exfiltration pattern evident. | ai | |
| semgrep | semgrep:child-process-spawn | AI (semgrep): CLI toolkit spawning processes is expected; consistent with ascf build tooling. | ai | |
| phantom-deps | phantom-dep:less | AI (phantom-deps): Peer/optional dep for webpack pipeline configuration; stable false positive. | ai | |
| phantom-deps | phantom-dep:sass | AI (phantom-deps): Peer/optional dep for webpack pipeline configuration; stable false positive. | ai | |
| phantom-deps | phantom-dep:eslint | AI (phantom-deps): Peer/optional dep for webpack pipeline configuration; stable false positive. | ai | |
| phantom-deps | phantom-dep:log4js | AI (phantom-deps): Logging dep referenced via config convention; stable false positive. | ai | |
| phantom-deps | phantom-dep:express | AI (phantom-deps): Dev server dep; stable false positive for this toolkit. | ai | |
| phantom-deps | phantom-dep:less-loader | AI (phantom-deps): Webpack loader dep declared for downstream consumers; stable false positive. | ai | |
| semgrep | semgrep:child-process-import | AI (semgrep): CLI build toolkit; child_process use in version-check.js is expected for a tool that runs system commands. | ai | |
| phantom-deps | phantom-dep:babel-loader | AI (phantom-deps): Webpack loader dep declared for downstream consumers; stable false positive. | ai | |
| phantom-deps | phantom-dep:@babel/runtime | AI (phantom-deps): Framework-scoped dep loaded by convention; stable false positive. | ai | |
| phantom-deps | phantom-dep:@babel/preset-env | AI (phantom-deps): Framework-scoped dep loaded by convention; stable false positive. | ai | |
| phantom-deps | phantom-dep:@babel/plugin-transform-runtime | AI (phantom-deps): Framework-scoped dep loaded by convention; stable false positive. | ai | |
| phantom-deps | phantom-dep:@babel/plugin-transform-class-properties | AI (phantom-deps): Framework-scoped dep loaded by convention; stable false positive. | ai | |
| phantom-deps | phantom-dep:@babel/plugin-transform-modules-commonjs | AI (phantom-deps): Framework-scoped dep loaded by convention; stable false positive. | ai | |
| phantom-deps | phantom-dep:sass-loader | AI (phantom-deps): Webpack loader dep declared for downstream consumers; stable false positive. | ai | |
| semgrep | semgrep:dynamic-require | AI (semgrep): extract-loader.js is a webpack loader; dynamic require is inherent to loader design. | ai | |
| phantom-deps | phantom-dep:tar | AI (phantom-deps): Toolkit declares deps for downstream consumers; phantom-dep heuristic is a stable false positive here. | ai |
Versions (showing 8 of 8)
| Version | Deps | Published |
|---|---|---|
| 1.0.17 | 36 / 9 | |
| 1.0.16 | 35 / 9 | |
| 1.0.15 | 35 / 7 | |
| 1.0.14 | 35 / 7 | |
| 1.0.13 | 35 / 7 | |
| 1.0.12 | 34 / 7 | |
| 1.0.11 | 34 / 7 | |
| 1.0.10 | 33 / 7 |
v1.0.17
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.16
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.15
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.14
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.13
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.12
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.11
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.10
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.