@cedarjs/eslint-config — Greenflagged

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.

Maintainers

tobbe

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
phantom-deps	phantom-dep:@babel/eslint-parser	AI (phantom-deps): ESLint config; parser loaded by convention, not direct import.	ai	2026/05/27
phantom-deps	phantom-dep:@babel/core	AI (phantom-deps): ESLint config; Babel parser loaded by convention, not direct import.	ai	2026/05/27
phantom-deps	phantom-dep:eslint-plugin-react	AI (phantom-deps): ESLint config; plugins referenced in config files, not direct imports.	ai	2026/05/27
phantom-deps	phantom-dep:eslint-plugin-jsx-a11y	AI (phantom-deps): ESLint config; plugin referenced in config, not direct import.	ai	2026/05/27
phantom-deps	phantom-dep:eslint-plugin-jest-dom	AI (phantom-deps): ESLint config; plugin referenced in config, not direct import.	ai	2026/05/27
phantom-deps	phantom-dep:@cedarjs/eslint-plugin	AI (phantom-deps): ESLint config; same-org plugin loaded by convention.	ai	2026/05/27
phantom-deps	phantom-dep:eslint-plugin-import	AI (phantom-deps): ESLint config; plugin referenced in config, not direct import.	ai	2026/05/27
phantom-deps	phantom-dep:@babel/eslint-plugin	AI (phantom-deps): ESLint config; plugin loaded by convention, not direct import.	ai	2026/05/27
phantom-deps	phantom-dep:eslint-plugin-react-hooks	AI (phantom-deps): ESLint config; plugin referenced in config, not direct import.	ai	2026/05/27
phantom-deps	phantom-dep:eslint-plugin-prettier	AI (phantom-deps): ESLint config; plugin referenced in config, not direct import.	ai	2026/05/27
dependencies	unvetted-dep:eslint-import-resolver-babel-module	AI (dependencies): Established babel-module import resolver; stable false positive for this ESLint config package.	ai	2026/04/28
dependencies	unvetted-dep:eslint-plugin-jest-dom	AI (dependencies): Well-known ESLint plugin for jest-dom; stable false positive for this ESLint config package.	ai	2026/04/28
dependencies	unvetted-dep:eslint-plugin-react-compiler	AI (dependencies): Official React compiler ESLint plugin; expected dependency for this ESLint config package.	ai	2026/04/28
phantom-deps	phantom-dep:eslint	AI (phantom-deps): ESLint config packages reference eslint in config files, not via import; stable false positive for this package type.	ai	2026/04/28
phantom-deps	phantom-dep:eslint-import-resolver-babel-module	AI (phantom-deps): Import resolver referenced in ESLint config settings, not directly imported; stable false positive.	ai	2026/04/28
phantom-deps	phantom-dep:@typescript-eslint/eslint-plugin	AI (phantom-deps): ESLint plugin referenced in config, not imported; stable false positive.	ai	2026/04/28
phantom-deps	phantom-dep:@typescript-eslint/parser	AI (phantom-deps): Parser referenced in ESLint config, not directly imported; stable false positive.	ai	2026/04/28
phantom-deps	phantom-dep:eslint-config-prettier	AI (phantom-deps): ESLint config referenced in config files, not imported; stable false positive.	ai	2026/04/28
phantom-deps	phantom-dep:eslint-plugin-babel	AI (phantom-deps): ESLint plugin referenced in config files, not imported; stable false positive for eslint-config packages.	ai	2026/04/28
phantom-deps	phantom-dep:@cedarjs/internal	AI (phantom-deps): Same-org sibling dep used in config context; stable false positive.	ai	2026/04/28
phantom-deps	phantom-dep:prettier	AI (phantom-deps): Referenced in eslint-config-prettier config, not directly imported; stable false positive.	ai	2026/04/28