← Home

@crossdelta/platform-sdk

Platform toolkit for event-driven microservices — keeping code and infrastructure in lockstep.

2
Versions
MIT
License
No
Install Scripts
Missing
Provenance

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.

Maintainers

marcelle

Keywords

cliscaffoldingmicroservicesturborepomonorepopulumiinfrastructure-as-codehononestjsbundevtools

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
phantom-deps phantom-dep:zx AI (phantom-deps): zx is listed as an esbuild external and used in CLI templates/config; phantom-dep false positive for this package. ai
phantom-deps phantom-dep:zod AI (phantom-deps): zod is bundled externally via esbuild config; phantom-dep false positive. ai
phantom-deps phantom-dep:vite AI (phantom-deps): vite is an esbuild external; phantom-dep false positive. ai
phantom-deps phantom-dep:rimraf AI (phantom-deps): rimraf is a declared dep used in build scripts; phantom-dep false positive. ai
phantom-deps phantom-dep:commander AI (phantom-deps): commander is bundled into cli.js via esbuild; phantom-dep false positive. ai
phantom-deps phantom-dep:package-up AI (phantom-deps): package-up is bundled into cli.js; phantom-dep false positive. ai
phantom-deps phantom-dep:enquirer AI (phantom-deps): Bundled CLI tool; deps consumed in bundled output. ai
phantom-deps phantom-dep:fs-extra AI (phantom-deps): Bundled CLI tool; deps consumed in bundled output. ai
phantom-deps phantom-dep:ts-morph AI (phantom-deps): Bundled CLI tool; deps consumed in bundled output. ai
phantom-deps phantom-dep:cli-table3 AI (phantom-deps): Bundled CLI tool; deps consumed in bundled output. ai
semgrep semgrep:env-spread AI (semgrep): Fires in minified CLI bundle on normal config/env handling patterns, not credential exfiltration. ai
phantom-deps phantom-dep:@faker-js/faker AI (phantom-deps): Bundled CLI tool; deps consumed in bundled output. ai
phantom-deps phantom-dep:@inquirer/prompts AI (phantom-deps): Bundled CLI tool; deps consumed in bundled output. ai
phantom-deps phantom-dep:@listr2/prompt-adapter-enquirer AI (phantom-deps): Bundled CLI tool; deps consumed in bundled output. ai
phantom-deps phantom-dep:terminal-link AI (phantom-deps): Bundled CLI tool; deps consumed in bundled output. ai
semgrep semgrep:hex-decode AI (semgrep): Fires in minified CLI bundle; code samples show template literals and CLI output, not malicious hex decoding. ai
phantom-deps phantom-dep:ora AI (phantom-deps): Bundled CLI tool; deps consumed in bundled output, not directly imported in analyzed source. ai
phantom-deps phantom-dep:jiti AI (phantom-deps): Bundled CLI tool; deps consumed in bundled output. ai
phantom-deps phantom-dep:dotenv AI (phantom-deps): Bundled CLI tool; deps consumed in bundled output. ai
phantom-deps phantom-dep:globby AI (phantom-deps): Bundled CLI tool; deps consumed in bundled output. ai

Versions (showing 2 of 2)

Version Deps Published
0.21.20 27 / 13
0.19.5 26 / 12

v0.21.20

4 findings
HIGH env-spread: bin/cli.mjs:20 semgrep

Spreading entire process.env into an object — may capture all secrets 18 | \x1B[36mpf new workspace my-platform\x1B[0m 19 | `);return e},F=e=>{let t=e??g();return ot(I(t,"package.json"))},E=e=>{let t=F(e);if(!t?.pf?.paths)return $e;let{paths:r} > 20 | `,encoding:"utf-8"})},Re=e=>{let t=_n();return Ra(Ia(t,e))},ir=null,cr=()=>(ir||(ir=Re("package.json")),ir),R=new Proxy( 21 | `).filter(Boolean);for(let s of o)try{process.kill(Number.parseInt(s,10),"SIGKILL")}catch{}}catch{}}f();var ct=e=>Ee(e); 22 | Running command: ${i} ${[...a,e,...n].join(" ")}

HIGH env-spread: bin/cli.mjs:20 semgrep

Spreading entire process.env into an object — may capture all secrets 18 | \x1B[36mpf new workspace my-platform\x1B[0m 19 | `);return e},F=e=>{let t=e??g();return ot(I(t,"package.json"))},E=e=>{let t=F(e);if(!t?.pf?.paths)return $e;let{paths:r} > 20 | `,encoding:"utf-8"})},Re=e=>{let t=_n();return Ra(Ia(t,e))},ir=null,cr=()=>(ir||(ir=Re("package.json")),ir),R=new Proxy( 21 | `).filter(Boolean);for(let s of o)try{process.kill(Number.parseInt(s,10),"SIGKILL")}catch{}}catch{}}f();var ct=e=>Ee(e); 22 | Running command: ${i} ${[...a,e,...n].join(" ")}

HIGH env-spread: bin/cli.mjs:576 semgrep

Spreading entire process.env into an object — may capture all secrets 574 | ${e.message}`)}},ye=()=>D().reduce((t,r)=>(r.initial&&t.push(r.name),t),[]),Dd=e=>!!e?.name&&!!e?.link&&!!e?.description 575 | `))}))},_d=e=>e.toUpperCase().replace(/-/g,"_"),ei=(e,t)=>{let r=_d(e);d.breakLine().log(ne.bold("Environment variables: > 576 | `),fn:()=>Gd(s,i,t,r,n)}))),Gd=async(e,t,r,n,o)=>{let s=`${Rt}:${e.name}`;try{if(e.interactive)return to(t,[],{cwd:r,con 577 | `)),e.shouldInstallBun=await r.toggle({message:"Would you like to use Bun? (recommended)",initial:!0}),e.shouldInstallBu 578 | `);throw new Error(`Policy violation(s) detected:

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.19.5

4 findings
HIGH env-spread: bin/cli.mjs:2 semgrep

Spreading entire process.env into an object — may capture all secrets 1 | #!/usr/bin/env node > 2 | import{A as Ur,C as Tt,D as Et,F as I,G as ue,H as $t,a as Or,b as T,c as Y,d as _r,e as Lr,f as A,g as wt,h as bt,i as 3 | `).filter(Boolean);for(let s of o)try{process.kill(Number.parseInt(s,10),"SIGKILL")}catch{}}catch{}}var Oe=e=>Ne(e);func 4 | Running command: ${i} ${[...a,e,...n].join(" ")}

HIGH env-spread: bin/cli.mjs:2 semgrep

Spreading entire process.env into an object — may capture all secrets 1 | #!/usr/bin/env node > 2 | import{A as Ur,C as Tt,D as Et,F as I,G as ue,H as $t,a as Or,b as T,c as Y,d as _r,e as Lr,f as A,g as wt,h as bt,i as 3 | `).filter(Boolean);for(let s of o)try{process.kill(Number.parseInt(s,10),"SIGKILL")}catch{}}catch{}}var Oe=e=>Ne(e);func 4 | Running command: ${i} ${[...a,e,...n].join(" ")}

HIGH env-spread: bin/cli.mjs:551 semgrep

Spreading entire process.env into an object — may capture all secrets 549 | ${e.message}`)}},se=()=>R().reduce((t,r)=>(r.initial&&t.push(r.name),t),[]),Hp=e=>!!e?.name&&!!e?.link&&!!e?.description 550 | `))}))},Gp=e=>e.toUpperCase().replace(/-/g,"_"),Zo=(e,t)=>{let r=Gp(e);d.breakLine().log(L.bold("Environment variables:" > 551 | `),fn:()=>Kp(s,i,t,r,n)}))),Kp=async(e,t,r,n,o)=>{let s=`${it}:${e.name}`;try{if(e.interactive)return Xr(t,[],{cwd:r,con 552 | `)),e.shouldInstallBun=await r.toggle({message:"Would you like to use Bun? (recommended)",initial:!0}),e.shouldInstallBu 553 | `);throw new Error(`Policy violation(s) detected:

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.