@backstage/plugin-devtools
8
Versions
Apache-2.0
License
No
Install Scripts
Missing
Provenance
Supply chain provenance
Status for the latest visible version.
No SLSA provenance
npm registry signatures
gitHead linked
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
patrikofrebenmarcuseide
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| phantom-deps | phantom-dep:@backstage/plugin-devtools-react | AI (phantom-deps): Same-org sibling dep declared in pluginPackages; phantom-dep heuristic misfires on bundled frontend plugins. | ai | |
| dependencies | unvetted-dep:react-json-view | AI (dependencies): react-json-view is a well-known React JSON viewer component; its use here is legitimate and consistent with the plugin's devtools UI purpose. | ai | |
| dependencies | unvetted-dep:@material-ui/lab | AI (dependencies): @material-ui/lab is the official MUI lab package, a standard companion to @material-ui/core which is already a dependency in this package. | ai | |
| phantom-deps | phantom-dep:@backstage/ui | AI (phantom-deps): Same-org Backstage dependency; phantom flag reflects monorepo build patterns, not a risk. | ai | |
| npm-metadata | no-description | AI (npm-metadata): Official Backstage monorepo package; missing description is a known metadata gap in their publishing pipeline, not a malice indicator. | ai | |
| phantom-deps | phantom-dep:@backstage/core-compat-api | AI (phantom-deps): Same-org Backstage dependency; phantom flag reflects monorepo build patterns, not a risk. | ai | |
| provenance | no-provenance | AI (provenance): Backstage packages do not currently publish with Sigstore provenance; this is consistent across all versions and not a risk signal. | ai | |
| phantom-deps | phantom-dep:lodash | AI (phantom-deps): lodash is a legitimate declared dependency; phantom detection may reflect indirect usage patterns in the Backstage monorepo build. | ai |