@cabloy/lint — Greenflagged

Node Style Guide for Cabloy.

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.

Maintainers

zhennann

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
phantom-deps	phantom-dep:eslint-plugin-unused-imports	AI (phantom-deps): ESLint plugin loaded by config convention, not direct import; stable pattern for this lint preset package.	ai	2026/05/29
phantom-deps	phantom-dep:eslint-plugin-toml	AI (phantom-deps): ESLint plugin loaded by config convention, not direct import; stable pattern for this lint preset package.	ai	2026/05/29
phantom-deps	phantom-dep:eslint-plugin-regexp	AI (phantom-deps): ESLint plugin loaded by config convention, not direct import; stable pattern for this lint preset package.	ai	2026/05/29
phantom-deps	phantom-dep:eslint-plugin-command	AI (phantom-deps): ESLint plugin loaded by config convention, not direct import; stable pattern for this lint preset package.	ai	2026/05/29
phantom-deps	phantom-dep:eslint-plugin-pnpm	AI (phantom-deps): ESLint plugin loaded by config convention, not direct import; stable pattern for this lint preset package.	ai	2026/05/29
dependencies	unvetted-dep:@antfu/eslint-config	AI (dependencies): @antfu/eslint-config is a widely-used, well-known ESLint config; stable false positive for this lint config package.	ai	2026/05/27
bogus-package	bogus-package	AI (bogus-package): Part of the Cabloy framework monorepo; mass-production pattern is expected for this publisher's scoped packages.	ai	2026/05/27
phantom-deps	phantom-dep:vue-eslint-parser	AI (phantom-deps): ESLint config packages load plugins by convention, not direct import.	ai	2026/04/28
phantom-deps	phantom-dep:@typescript-eslint/parser	AI (phantom-deps): ESLint config package; plugins are loaded by convention in config files, not direct imports.	ai	2026/04/28
typosquat	typosquat.levenshtein:eslint	AI (typosquat): Scoped package @cabloy/lint is a lint config preset, not a typosquat of eslint.	ai	2026/04/28
phantom-deps	phantom-dep:eslint-plugin-eslint-comments	AI (phantom-deps): ESLint config package; plugins are loaded by convention in config files, not direct imports.	ai	2026/04/28
typosquat	typosquat.levenshtein:pino	AI (typosquat): Scoped package @cabloy/lint is a lint config preset, not a typosquat of pino.	ai	2026/04/28
phantom-deps	phantom-dep:@eslint/json	AI (phantom-deps): ESLint config package; plugins are loaded by convention in config files, not direct imports.	ai	2026/04/28
phantom-deps	phantom-dep:@eslint/markdown	AI (phantom-deps): ESLint config package; plugins are loaded by convention in config files, not direct imports.	ai	2026/04/28
phantom-deps	phantom-dep:eslint-plugin-vue	AI (phantom-deps): ESLint config package; plugins are loaded by convention in config files, not direct imports.	ai	2026/04/28
phantom-deps	phantom-dep:typescript-eslint	AI (phantom-deps): ESLint config package; plugins are loaded by convention in config files, not direct imports.	ai	2026/04/28
phantom-deps	phantom-dep:@e18e/eslint-plugin	AI (phantom-deps): ESLint config package; plugins are loaded by convention in config files, not direct imports.	ai	2026/04/28
phantom-deps	phantom-dep:@stylistic/eslint-plugin	AI (phantom-deps): ESLint config package; plugins are loaded by convention in config files, not direct imports.	ai	2026/04/28