← Home

@builder.io/dev-tools

npm Homepage

Builder.io Visual CMS Devtools

51
Versions
MIT
License
No
Install Scripts
Missing
Provenance

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.

Maintainers

steve8708samijaberteleaziz123mrkoreyemheverygustavohgsmanucorporatsanyamkamatbengironemidhunadarvinkylefowlerbuilderio-botarmelaaishwarya_parabemmaacanaghavarhadesidmohanty11jcortesebuildervishwasgopinathnicholaskoechfloating_dynamopaprikafpabloelisseoliamdebeasi

Keywords

builder.iobuilderiocmsdesign to codedev-toolsdevtoolsdrag and dropfigmafigma to codefigma to reactnextqwikreactremixvcpvisual cmsvisual copilotvisual editor

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
phantom-deps phantom-dep:chokidar AI (phantom-deps): Phantom dep pattern is stable for this package. ai
phantom-deps phantom-dep:ignore AI (phantom-deps): Phantom dep pattern is stable for this package. ai
phantom-deps phantom-dep:zod AI (phantom-deps): Phantom dep pattern is stable for this package; deps referenced via config conventions. ai
publish-pattern rapid-publish AI (publish-pattern): Automated CI/CD pipeline for a high-velocity package (2460 versions); rapid successive publishes are expected. ai
provenance publisher-changed AI (provenance): Builder.io migrated publishing to GitHub Actions CI; consistent with org-level automation across their many packages. ai
source-diff obfuscated-file:types/cli/utils/repo-indexing-group-prompts.d.ts AI (source-diff): Long-line .d.ts file contains a readable LLM prompt string constant, not obfuscated/minified code. ai
dependencies unvetted-dep:http-proxy AI (dependencies): http-proxy is a well-established library; stable dependency for this package across many versions. ai
publish-pattern new-deps-added AI (publish-pattern): zod is a well-established validation library; addition is benign for this package. ai
source-diff obfuscated-file:types/cli/utils/repo-indexing-agent-prompt.d.ts AI (source-diff): Same pattern — exported prompt template string in a .d.ts file, not obfuscation. ai
source-diff obfuscated-file:types/cli/utils/component-group-mdx-prompt.d.ts AI (source-diff): Long-line .d.ts files are LLM prompt string constants, not obfuscated code; pattern stable for this package. ai
maintainer-change maintainer-added AI (maintainer-change): Large org package with frequent releases; new maintainer addition consistent with team growth, not compromise. ai
phantom-deps phantom-dep:http-proxy-middleware AI (phantom-deps): Proxy middleware is a documented feature; dynamic loading pattern is expected for this dev-tools package. ai
phantom-deps phantom-dep:@vscode/ripgrep AI (phantom-deps): IDE integration dep; conditionally loaded in dev-tools context, not a direct import. ai
phantom-deps phantom-dep:http-proxy AI (phantom-deps): Proxy functionality is a documented feature of this dev-tools package; dynamic loading pattern is expected. ai
phantom-deps phantom-dep:express AI (phantom-deps): Dev-tools package; express is a peer/optional runtime dep loaded dynamically, not a direct import. ai
provenance no-provenance AI (provenance): Established package; provenance is a best-practice enhancement, not a security blocker. ai
semgrep semgrep:base64-decode AI (semgrep): Same context as hex-decode — dotenv parsing code, not malicious payload handling. ai
semgrep semgrep:hex-decode AI (semgrep): Sample shows dotenv escape sequence parsing (\r, \n handling), not malicious payload decoding. ai
semgrep semgrep:env-bulk-read AI (semgrep): Bundled dotenv/config library code reading process.env keys — standard behavior for a dev-tools package that manages environment configuration. ai
semgrep semgrep:child-process-spawn AI (semgrep): Same rationale as child-process-import — legitimate dev-tools usage for spawning build/CLI processes. ai
semgrep semgrep:child-process-import AI (semgrep): Dev-tools package legitimately spawns child processes for build tooling, CLI commands. Bundled minified code context shows standard tooling usage, not malicious behavior. ai
phantom-deps phantom-dep:tsx AI (phantom-deps): tsx is a common TypeScript execution tool referenced in dev-tools config files; phantom-dep pattern is expected for this package type. ai
dependencies unvetted-dep:@lvce-editor/ripgrep AI (dependencies): @lvce-editor/ripgrep is a ripgrep binary wrapper appropriate for a dev-tools package doing file search; its use is consistent with the package's purpose. ai
phantom-deps phantom-dep:http-proxy-3 AI (phantom-deps): http-proxy-3 referenced in config files for dev server proxying is expected behavior for a dev-tools package. ai
phantom-deps phantom-dep:@lvce-editor/ripgrep AI (phantom-deps): Consistent with the dependency finding; conditionally loaded in config, appropriate for dev-tools file search functionality. ai
phantom-deps phantom-dep:@types/ws AI (phantom-deps): Type-only package loaded by convention in dev-tools context; not a security concern. ai
phantom-deps phantom-dep:glob AI (phantom-deps): Dev-tools package; phantom deps are config-referenced optional/conditional imports, not a security concern for this package. ai
dependencies unvetted-dep:@amplitude/analytics-node AI (dependencies): Official Amplitude analytics SDK; standard telemetry dependency for dev tools. Legitimate use. ai
dependencies unvetted-dep:launch-editor AI (dependencies): launch-editor is a well-known utility used by major dev tools (Vue CLI, CRA) to open files in editors; legitimate use in dev-tools context. ai
phantom-deps phantom-dep:@tootallnate/quickjs-emscripten AI (phantom-deps): Dev-tools package; phantom deps are config-referenced optional/conditional imports, not a security concern for this package. ai
phantom-deps phantom-dep:utf-8-validate AI (phantom-deps): Dev-tools package; phantom deps are config-referenced optional/conditional imports, not a security concern for this package. ai
phantom-deps phantom-dep:@clack/prompts AI (phantom-deps): Dev-tools package; phantom deps are config-referenced optional/conditional imports, not a security concern for this package. ai
phantom-deps phantom-dep:cookie-parser AI (phantom-deps): Dev-tools package; phantom deps are config-referenced optional/conditional imports, not a security concern for this package. ai
phantom-deps phantom-dep:pac-resolver AI (phantom-deps): Dev-tools package; phantom deps are config-referenced optional/conditional imports, not a security concern for this package. ai
phantom-deps phantom-dep:cli-progress AI (phantom-deps): Dev-tools package; phantom deps are config-referenced optional/conditional imports, not a security concern for this package. ai
phantom-deps phantom-dep:detect-port AI (phantom-deps): Dev-tools package; phantom deps are config-referenced optional/conditional imports, not a security concern for this package. ai
phantom-deps phantom-dep:strip-ansi AI (phantom-deps): Dev-tools package; phantom deps are config-referenced optional/conditional imports, not a security concern for this package. ai
phantom-deps phantom-dep:micromatch AI (phantom-deps): Dev-tools package; phantom deps are config-referenced optional/conditional imports, not a security concern for this package. ai
phantom-deps phantom-dep:bufferutil AI (phantom-deps): Dev-tools package; phantom deps are config-referenced optional/conditional imports, not a security concern for this package. ai
phantom-deps phantom-dep:get-port AI (phantom-deps): Dev-tools package; phantom deps are config-referenced optional/conditional imports, not a security concern for this package. ai
phantom-deps phantom-dep:prompts AI (phantom-deps): Dev-tools package; phantom deps are config-referenced optional/conditional imports, not a security concern for this package. ai
phantom-deps phantom-dep:open AI (phantom-deps): Dev-tools package; phantom deps are config-referenced optional/conditional imports, not a security concern for this package. ai
npm-metadata bundled-binaries AI (npm-metadata): Bundled binaries are ripgrep (rg/rg.exe) — a well-known open-source search tool. Bundling platform-specific ripgrep binaries is a standard pattern for dev tools requiring fast file search. ai
semgrep semgrep:api-obfuscation-reflect AI (semgrep): Reflect.get() in bundled CJS output is a common pattern in transpiled/bundled JavaScript frameworks. No evidence of malicious intent in the code samples. ai
semgrep semgrep:new-function-constructor AI (semgrep): Appears in bundled/minified CJS output (node/index.cjs). Code context shows template literal parsing (Babel/parser internals), not dynamic code execution of untrusted input. ai

Versions (showing 51 of 507)

View all versions
Version Deps Published
1.64.1 27 / 4
1.64.0 27 / 4
1.63.1 27 / 4
1.63.0 27 / 4
1.62.0 27 / 4
1.61.4 27 / 4
1.61.3 27 / 4
1.61.2 27 / 4
1.61.1 27 / 4
1.61.0 27 / 4
1.60.1 27 / 4
1.60.0 27 / 4
1.59.2 27 / 4
1.59.1 27 / 4
1.59.0 27 / 4
1.58.2 27 / 4
1.58.1 27 / 4
1.58.0 27 / 4
1.57.0 27 / 4
1.56.0 27 / 4
1.55.1 27 / 4
1.55.0 27 / 4
1.54.1 27 / 4
1.54.0 27 / 4
1.53.4 27 / 4
1.53.3 27 / 4
1.53.2 26 / 4
1.53.1 26 / 4
1.53.0 26 / 4
1.52.0 26 / 4
1.51.1 26 / 4
1.51.0 26 / 4
1.50.1 26 / 4
1.48.3 26 / 4
1.48.2 26 / 4
1.48.1 26 / 4
1.48.0 26 / 4
1.47.2 26 / 4
1.47.1 26 / 4
1.47.0 26 / 4
1.46.1 26 / 4
1.46.0 26 / 4
1.45.1 26 / 4
1.45.0 26 / 4
1.44.1 26 / 4
1.44.0 26 / 4
1.43.0 26 / 4
1.42.1 26 / 4
1.42.0 26 / 4
1.41.10 26 / 4
1.41.9 26 / 4

v1.64.1

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.64.0

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.63.1

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.63.0

2 findings
HIGH Publisher changed: manucorporat → GitHub Actions (on 2026-06-02) provenance

This version was published by a different npm account than previous versions on 2026-06-02. This could indicate a legitimate maintainer transition or an account compromise.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.62.0

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.61.4

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.61.3

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.61.2

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.61.1

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.61.0

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.60.1

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.60.0

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.59.2

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.59.1

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.59.0

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.58.2

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.58.1

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.58.0

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.57.0

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.56.0

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.55.1

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.55.0

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.54.1

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.54.0

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.53.4

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.53.3

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.53.2

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.53.1

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.53.0

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.52.0

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.51.1

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.48.3

2 findings
HIGH Bundled binary files (5) npm-metadata

Package contains compiled binaries that could be backdoors: • vendors/darwin-arm64/rg • vendors/darwin-x64/rg • vendors/linux-arm64/rg • vendors/linux-x64/rg • vendors/win32-x64/rg.exe

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.48.2

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.48.1

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.48.0

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.47.2

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.47.1

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.47.0

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.46.1

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.46.0

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.45.1

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.45.0

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.44.1

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.44.0

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.43.0

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.42.1

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.42.0

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.41.10

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.41.9

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.