@backstage/plugin-scaffolder-backend-module-github No license 33 versions

@backstage/plugin-scaffolder-backend-module-github

npm Repository

33

Versions

—

License

No

Install Scripts

Missing

Provenance

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.

Maintainers

patrikofrebenmarcuseide

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
dependencies	unvetted-dep:octokit	AI (dependencies): octokit is the official GitHub SDK; a standard and expected dependency for a GitHub scaffolder backend module.	ai	2026/04/25
dependencies	unvetted-dep:@backstage/types	AI (dependencies): First-party Backstage package from the same monorepo; always a legitimate dependency for Backstage plugins.	ai	2026/04/25
dependencies	unvetted-dep:@octokit/webhooks	AI (dependencies): Official Octokit webhooks library; expected dependency for a GitHub integration plugin.	ai	2026/04/25
dependencies	unvetted-dep:@backstage/backend-plugin-api	AI (dependencies): First-party Backstage package from the same monorepo; standard dependency for all Backstage backend plugin modules.	ai	2026/04/25
dependencies	unvetted-dep:@backstage/plugin-scaffolder-node	AI (dependencies): First-party Backstage package from the same monorepo; the core scaffolder node package this module extends.	ai	2026/04/25
dependencies	unvetted-dep:octokit-plugin-create-pull-request	AI (dependencies): Well-known Octokit plugin for PR creation; expected dependency for a GitHub scaffolder module.	ai	2026/04/25
phantom-deps	phantom-dep:zod	AI (phantom-deps): zod is used in config/schema definitions in Backstage plugins; indirect usage pattern is normal for this ecosystem.	ai	2026/04/25
phantom-deps	phantom-dep:@backstage/types	AI (phantom-deps): Same-org Backstage package; indirect usage is common in the Backstage monorepo plugin pattern.	ai	2026/04/25
phantom-deps	phantom-dep:@backstage/catalog-model	AI (phantom-deps): Same-org Backstage package; indirect usage is common in the Backstage monorepo plugin pattern.	ai	2026/04/25
bogus-package	bogus-package	AI (bogus-package): Backstage monorepo plugins have minimal standalone READMEs and no keywords by convention; not indicative of spam.	ai	2026/04/25

Versions (showing 33 of 33)

Version	Deps	Published
0.9.11	16 / 6	2026-07-14
0.9.10	16 / 6	2026-06-16
0.9.9	16 / 6	2026-05-19
0.9.8	14 / 6	2026-04-14
0.9.7	14 / 6	2026-03-17
0.9.6	14 / 6	2026-02-17
0.9.5	14 / 6	2026-01-28
0.9.4	14 / 6	2026-01-20
0.9.3	14 / 6	2025-12-16
0.9.2	14 / 6	2025-11-18
0.9.1	14 / 6	2025-10-14
0.9.0	14 / 6	2025-09-16
0.8.2	14 / 6	2025-08-19
0.8.1	14 / 6	2025-07-15
0.8.0	14 / 6	2025-06-17
0.7.1	13 / 6	2025-05-20
0.7.0	13 / 6	2025-04-15
0.6.1	13 / 6	2025-03-18
0.6.0	13 / 6	2025-02-18
0.5.5	13 / 6	2025-01-14
0.5.4	13 / 6	2024-12-17
0.5.3	13 / 6	2024-11-29
0.5.2	13 / 6	2024-11-19
0.5.1	13 / 6	2024-10-15
0.5.0	13 / 6	2024-09-17
0.4.2	11 / 6	2024-08-27
0.4.1	11 / 6	2024-08-20
0.4.0	11 / 6	2024-07-16
0.3.2	11 / 6	2024-06-26
0.3.1	11 / 6	2024-06-19
0.3.0	11 / 6	2024-06-18
0.2.8	11 / 6	2024-05-14
0.2.7	11 / 7	2024-04-16

v0.9.11

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.9.7

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.9.5

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.9.4

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.9.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.9.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.7.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.6.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.6.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.5.5

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.5.4

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.5.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.5.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.5.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.5.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.4.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.4.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.4.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.3.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.3.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.3.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.2.8

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.2.7

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.