@blocklet/pages-kit-block-studio

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures No source commit

Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.

Maintainers

wangshijungxw

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
phantom-deps	phantom-dep:esbuild	AI (phantom-deps): Build tool; esbuild is a known implicit runtime/binary dependency for this package.	ai	2026/05/14
dependencies	unvetted-dep:ts-to-zod	AI (dependencies): ts-to-zod is a well-known TypeScript-to-Zod schema converter; use here is consistent with the package's schema generation utilities.	ai	2026/05/12
semgrep	semgrep:env-spread	AI (semgrep): Spreading process.env into child_process spawn options is standard practice for inheriting env in build tools.	ai	2026/05/12
semgrep	semgrep:dynamic-require	AI (semgrep): Dynamic require loads a local package.json path in a Vite plugin — not arbitrary user-controlled input.	ai	2026/05/12
phantom-deps	phantom-dep:gogocode	AI (phantom-deps): Declared in package.json dependencies; used via config/scripts rather than direct import.	ai	2026/05/12
phantom-deps	phantom-dep:copyfiles	AI (phantom-deps): Used as a CLI tool in build scripts, not imported directly.	ai	2026/05/12
phantom-deps	phantom-dep:react-dom	AI (phantom-deps): Peer/runtime dependency used by bundled React components, not directly imported in source.	ai	2026/05/12
phantom-deps	phantom-dep:@mdx-js/react	AI (phantom-deps): MDX peer dependency used at runtime by consumers, not directly imported in this package's source.	ai	2026/05/12
phantom-deps	phantom-dep:crypto-browserify	AI (phantom-deps): Polyfill declared for Vite bundling config, not directly imported in source.	ai	2026/05/12
semgrep	semgrep:child-process-import	AI (semgrep): Build-tool middleware spawning subprocesses is expected for this package's documented functionality.	ai	2026/05/12

Versions (showing 51 of 196)

View all versions

Version	Deps	Published
0.7.39	35 / 12	2026-05-20
0.7.38	35 / 12	2026-05-20
0.7.37	35 / 12	2026-01-05
0.7.36	35 / 12	2025-12-23
0.7.35	35 / 12	2025-12-17
0.7.34	35 / 12	2025-12-17
0.7.33	35 / 12	2025-12-17
0.7.32	35 / 12	2025-12-17
0.7.31	35 / 12	2025-12-15
0.7.30	35 / 12	2025-12-11
0.7.29	35 / 12	2025-12-11
0.7.28	35 / 12	2025-12-09
0.7.27	35 / 12	2025-11-28
0.7.26	35 / 12	2025-11-24
0.7.25	35 / 12	2025-11-21
0.7.24	35 / 12	2025-11-20
0.7.23	35 / 12	2025-11-20
0.7.22	35 / 12	2025-11-20
0.7.21	35 / 12	2025-11-20
0.7.20	35 / 12	2025-11-17
0.7.19	35 / 12	2025-11-17
0.7.18	35 / 12	2025-11-14
0.7.17	35 / 12	2025-11-13
0.7.16	35 / 12	2025-11-12
0.7.15	35 / 12	2025-11-10
0.7.14	35 / 12	2025-11-07
0.7.13	35 / 12	2025-11-06
0.7.12	35 / 12	2025-11-06
0.7.11	35 / 12	2025-11-05
0.7.10	35 / 12	2025-11-05
0.7.9	35 / 12	2025-11-05
0.7.8	35 / 12	2025-11-05
0.7.7	35 / 12	2025-11-04
0.7.6	35 / 12	2025-11-03
0.7.5	35 / 12	2025-11-01
0.7.4	35 / 12	2025-10-31
0.7.3	35 / 12	2025-10-30
0.7.2	35 / 12	2025-10-30
0.7.1	35 / 12	2025-10-30
0.7.0	35 / 12	2025-10-29
0.6.107	35 / 12	2025-10-29
0.6.106	35 / 12	2025-10-28
0.6.105	35 / 12	2025-10-28
0.6.104	35 / 12	2025-10-28
0.6.103	35 / 12	2025-10-27
0.6.102	35 / 12	2025-10-24
0.6.101	35 / 12	2025-10-24
0.6.100	35 / 12	2025-10-23
0.6.99	35 / 12	2025-10-17
0.6.98	35 / 12	2025-10-16
0.6.97	35 / 12	2025-10-15

v0.7.39

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.7.38

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.7.37

3 findings

HIGH env-spread: lib/cjs/middlewares/init-resource-router.js:66 semgrep

Spreading entire process.env into an object — may capture all secrets 64 | stdio: 'inherit', 65 | shell: true, > 66 | env: { 67 | ...process.env, 68 | FORCE_COLOR: '1',

HIGH env-spread: lib/esm/middlewares/init-resource-router.js:63 semgrep

Spreading entire process.env into an object — may capture all secrets 61 | stdio: 'inherit', 62 | shell: true, > 63 | env: { 64 | ...process.env, 65 | FORCE_COLOR: '1',

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.7.36

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.7.35

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.7.34

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.7.33

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.7.32

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.7.31

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.7.30

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.7.29

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.7.28

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.7.27

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.7.26

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.7.25

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.7.24

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.7.23

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.7.22

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.7.21

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.7.20

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.7.19

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.7.18

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.7.17

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.7.16

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.7.15

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.7.14

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.7.13

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.7.12

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.7.11

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.7.10

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.7.9

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.7.8

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.7.7

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.7.6

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.7.5

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.7.4

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.7.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.7.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.7.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.7.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.6.107

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.6.106

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.6.105

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.6.104

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.6.103

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.6.102

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.6.101

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.6.100

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.6.99

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.6.98

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.6.97

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.