@crossdelta/platform-sdk
Platform toolkit for event-driven microservices — keeping code and infrastructure in lockstep.
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| phantom-deps | phantom-dep:zx | AI (phantom-deps): zx is listed as an esbuild external and used in CLI templates/config; phantom-dep false positive for this package. | ai | |
| phantom-deps | phantom-dep:zod | AI (phantom-deps): zod is bundled externally via esbuild config; phantom-dep false positive. | ai | |
| phantom-deps | phantom-dep:vite | AI (phantom-deps): vite is an esbuild external; phantom-dep false positive. | ai | |
| phantom-deps | phantom-dep:rimraf | AI (phantom-deps): rimraf is a declared dep used in build scripts; phantom-dep false positive. | ai | |
| phantom-deps | phantom-dep:commander | AI (phantom-deps): commander is bundled into cli.js via esbuild; phantom-dep false positive. | ai | |
| phantom-deps | phantom-dep:package-up | AI (phantom-deps): package-up is bundled into cli.js; phantom-dep false positive. | ai | |
| phantom-deps | phantom-dep:enquirer | AI (phantom-deps): Bundled CLI tool; deps consumed in bundled output. | ai | |
| phantom-deps | phantom-dep:fs-extra | AI (phantom-deps): Bundled CLI tool; deps consumed in bundled output. | ai | |
| phantom-deps | phantom-dep:ts-morph | AI (phantom-deps): Bundled CLI tool; deps consumed in bundled output. | ai | |
| phantom-deps | phantom-dep:cli-table3 | AI (phantom-deps): Bundled CLI tool; deps consumed in bundled output. | ai | |
| semgrep | semgrep:env-spread | AI (semgrep): Fires in minified CLI bundle on normal config/env handling patterns, not credential exfiltration. | ai | |
| phantom-deps | phantom-dep:@faker-js/faker | AI (phantom-deps): Bundled CLI tool; deps consumed in bundled output. | ai | |
| phantom-deps | phantom-dep:@inquirer/prompts | AI (phantom-deps): Bundled CLI tool; deps consumed in bundled output. | ai | |
| phantom-deps | phantom-dep:@listr2/prompt-adapter-enquirer | AI (phantom-deps): Bundled CLI tool; deps consumed in bundled output. | ai | |
| phantom-deps | phantom-dep:terminal-link | AI (phantom-deps): Bundled CLI tool; deps consumed in bundled output. | ai | |
| semgrep | semgrep:hex-decode | AI (semgrep): Fires in minified CLI bundle; code samples show template literals and CLI output, not malicious hex decoding. | ai | |
| phantom-deps | phantom-dep:ora | AI (phantom-deps): Bundled CLI tool; deps consumed in bundled output, not directly imported in analyzed source. | ai | |
| phantom-deps | phantom-dep:jiti | AI (phantom-deps): Bundled CLI tool; deps consumed in bundled output. | ai | |
| phantom-deps | phantom-dep:dotenv | AI (phantom-deps): Bundled CLI tool; deps consumed in bundled output. | ai | |
| phantom-deps | phantom-dep:globby | AI (phantom-deps): Bundled CLI tool; deps consumed in bundled output. | ai |
v0.21.20
4 findingsSpreading entire process.env into an object — may capture all secrets 18 | \x1B[36mpf new workspace my-platform\x1B[0m 19 | `);return e},F=e=>{let t=e??g();return ot(I(t,"package.json"))},E=e=>{let t=F(e);if(!t?.pf?.paths)return $e;let{paths:r} > 20 | `,encoding:"utf-8"})},Re=e=>{let t=_n();return Ra(Ia(t,e))},ir=null,cr=()=>(ir||(ir=Re("package.json")),ir),R=new Proxy( 21 | `).filter(Boolean);for(let s of o)try{process.kill(Number.parseInt(s,10),"SIGKILL")}catch{}}catch{}}f();var ct=e=>Ee(e); 22 | Running command: ${i} ${[...a,e,...n].join(" ")}
Spreading entire process.env into an object — may capture all secrets 18 | \x1B[36mpf new workspace my-platform\x1B[0m 19 | `);return e},F=e=>{let t=e??g();return ot(I(t,"package.json"))},E=e=>{let t=F(e);if(!t?.pf?.paths)return $e;let{paths:r} > 20 | `,encoding:"utf-8"})},Re=e=>{let t=_n();return Ra(Ia(t,e))},ir=null,cr=()=>(ir||(ir=Re("package.json")),ir),R=new Proxy( 21 | `).filter(Boolean);for(let s of o)try{process.kill(Number.parseInt(s,10),"SIGKILL")}catch{}}catch{}}f();var ct=e=>Ee(e); 22 | Running command: ${i} ${[...a,e,...n].join(" ")}
Spreading entire process.env into an object — may capture all secrets 574 | ${e.message}`)}},ye=()=>D().reduce((t,r)=>(r.initial&&t.push(r.name),t),[]),Dd=e=>!!e?.name&&!!e?.link&&!!e?.description 575 | `))}))},_d=e=>e.toUpperCase().replace(/-/g,"_"),ei=(e,t)=>{let r=_d(e);d.breakLine().log(ne.bold("Environment variables: > 576 | `),fn:()=>Gd(s,i,t,r,n)}))),Gd=async(e,t,r,n,o)=>{let s=`${Rt}:${e.name}`;try{if(e.interactive)return to(t,[],{cwd:r,con 577 | `)),e.shouldInstallBun=await r.toggle({message:"Would you like to use Bun? (recommended)",initial:!0}),e.shouldInstallBu 578 | `);throw new Error(`Policy violation(s) detected:
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.19.5
4 findingsSpreading entire process.env into an object — may capture all secrets 1 | #!/usr/bin/env node > 2 | import{A as Ur,C as Tt,D as Et,F as I,G as ue,H as $t,a as Or,b as T,c as Y,d as _r,e as Lr,f as A,g as wt,h as bt,i as 3 | `).filter(Boolean);for(let s of o)try{process.kill(Number.parseInt(s,10),"SIGKILL")}catch{}}catch{}}var Oe=e=>Ne(e);func 4 | Running command: ${i} ${[...a,e,...n].join(" ")}
Spreading entire process.env into an object — may capture all secrets 1 | #!/usr/bin/env node > 2 | import{A as Ur,C as Tt,D as Et,F as I,G as ue,H as $t,a as Or,b as T,c as Y,d as _r,e as Lr,f as A,g as wt,h as bt,i as 3 | `).filter(Boolean);for(let s of o)try{process.kill(Number.parseInt(s,10),"SIGKILL")}catch{}}catch{}}var Oe=e=>Ne(e);func 4 | Running command: ${i} ${[...a,e,...n].join(" ")}
Spreading entire process.env into an object — may capture all secrets 549 | ${e.message}`)}},se=()=>R().reduce((t,r)=>(r.initial&&t.push(r.name),t),[]),Hp=e=>!!e?.name&&!!e?.link&&!!e?.description 550 | `))}))},Gp=e=>e.toUpperCase().replace(/-/g,"_"),Zo=(e,t)=>{let r=Gp(e);d.breakLine().log(L.bold("Environment variables:" > 551 | `),fn:()=>Kp(s,i,t,r,n)}))),Kp=async(e,t,r,n,o)=>{let s=`${it}:${e.name}`;try{if(e.interactive)return Xr(t,[],{cwd:r,con 552 | `)),e.shouldInstallBun=await r.toggle({message:"Would you like to use Bun? (recommended)",initial:!0}),e.shouldInstallBu 553 | `);throw new Error(`Policy violation(s) detected:
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.