@dathomir/core
dathomir package
8
Versions
MPL-2.0
License
No
Install Scripts
Verified
Provenance
Supply chain provenance
Status for the latest visible version.
SLSA provenance attestation
npm registry signatures
No source commit
Maintainers
takuma-ru
Keywords
dathomirframeworkfrontendjavascripttypescript
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| dependencies | unvetted-dep:@dathomir/store | AI (dependencies): @dathomir/store is a first-party sibling package in the same dathomir-js monorepo; flagging it as unvetted is a stable false positive for this package family. | ai | |
| publish-pattern | new-deps-added | AI (publish-pattern): The new dep is @dathomir/store, a same-namespace monorepo sibling. Adding internal sibling deps is expected as the framework grows; not an injection risk. | ai | |
| typosquat | typosquat.levenshtein:cors | AI (typosquat): @dathomir/core is the core package of the dathomir framework monorepo; the levenshtein match to 'cors' is coincidental and not an impersonation attempt. | ai |