@backstage/plugin-auth-backend-module-oidc-provider

The oidc-provider backend module for the auth plugin.

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.

Maintainers

patrikofrebenmarcuseide

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
bogus-package	bogus-package	AI (bogus-package): Backstage monorepo packages consistently have minimal standalone READMEs and no keywords; this is a structural pattern of the project, not a spam indicator.	ai	2026/04/25
phantom-deps	phantom-dep:express	AI (phantom-deps): express is a declared runtime dependency used in Backstage plugin architecture; phantom detection reflects indirect usage pattern common in this ecosystem.	ai	2026/04/25
phantom-deps	phantom-dep:passport	AI (phantom-deps): passport is a declared runtime dependency used in Backstage auth plugin architecture; indirect usage is expected.	ai	2026/04/25
phantom-deps	phantom-dep:zod	AI (phantom-deps): zod is a declared runtime dependency used for config schema validation in Backstage plugins; indirect usage via config files is expected.	ai	2026/04/25
phantom-deps	phantom-dep:@backstage/plugin-auth-backend	AI (phantom-deps): Same-org Backstage dependency used as a plugin extension point; indirect usage is expected in Backstage module architecture.	ai	2026/04/25