@dfosco/storyboard
Storyboard prototyping framework — core engine, React integration, and canvas
44
Versions
MIT
License
No
Install Scripts
Verified
Provenance
Supply chain provenance
Status for the latest visible version.
SLSA provenance attestation
npm registry signatures
gitHead linked
Maintainers
dfosco
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| semgrep | semgrep:shady-links-raw-ip | AI (semgrep): Fires in test file asserting localhost/127.0.0.1 URLs are detected as local dev — not a runtime network call. | ai | |
| phantom-deps | phantom-dep:@mdx-js/mdx | AI (phantom-deps): Declared as optional peer dep; referenced in config files — phantom-dep heuristic false positive. | ai | |
| phantom-deps | phantom-dep:@codemirror/search | AI (phantom-deps): Optional peer dep; phantom-dep false positive. | ai | |
| phantom-deps | phantom-dep:@codemirror/commands | AI (phantom-deps): Optional peer dep; phantom-dep false positive. | ai | |
| phantom-deps | phantom-dep:@codemirror/lang-css | AI (phantom-deps): Optional peer dep; phantom-dep false positive. | ai | |
| phantom-deps | phantom-dep:@codemirror/language | AI (phantom-deps): Optional peer dep; phantom-dep false positive. | ai | |
| phantom-deps | phantom-dep:@codemirror/lang-html | AI (phantom-deps): Optional peer dep; phantom-dep false positive. | ai | |
| phantom-deps | phantom-dep:@codemirror/lang-json | AI (phantom-deps): Optional peer dep; phantom-dep false positive. | ai | |
| phantom-deps | phantom-dep:@codemirror/lang-yaml | AI (phantom-deps): Optional peer dep; phantom-dep false positive. | ai | |
| phantom-deps | phantom-dep:@codemirror/lang-python | AI (phantom-deps): Optional peer dep; phantom-dep false positive. | ai | |
| phantom-deps | phantom-dep:@codemirror/autocomplete | AI (phantom-deps): Optional peer dep; phantom-dep false positive. | ai | |
| phantom-deps | phantom-dep:@codemirror/lang-markdown | AI (phantom-deps): Optional peer dep; phantom-dep false positive. | ai | |
| phantom-deps | phantom-dep:@codemirror/theme-one-dark | AI (phantom-deps): Optional peer dep; phantom-dep false positive. | ai | |
| phantom-deps | phantom-dep:@codemirror/lang-javascript | AI (phantom-deps): Optional peer dep; phantom-dep false positive. | ai | |
| semgrep | semgrep:etc-passwd-access | AI (semgrep): Appears only in a test asserting that /etc/passwd path traversal is blocked — not credential harvesting. | ai | |
| semgrep | semgrep:eval-usage | AI (semgrep): eval() is in a test file validating inline bootstrap script output, not production code. | ai | |
| phantom-deps | phantom-dep:codemirror | AI (phantom-deps): Declared as optional peer dep; referenced in config files — phantom-dep heuristic false positive for this package. | ai | |
| phantom-deps | phantom-dep:@codemirror/view | AI (phantom-deps): Optional peer dep; phantom-dep false positive. | ai | |
| phantom-deps | phantom-dep:@codemirror/state | AI (phantom-deps): Optional peer dep; phantom-dep false positive. | ai | |
| semgrep | semgrep:silent-process-exec-var | AI (semgrep): Same detached dev-server spawn as silent-process-exec; legitimate CLI tooling pattern. | ai | |
| semgrep | semgrep:base64-decode | AI (semgrep): Decodes base64 image data with size guard — standard image handling, not payload execution. | ai | |
| semgrep | semgrep:env-bulk-read | AI (semgrep): Enumerates env keys to unset shell config vars inside tmux — legitimate terminal isolation logic. | ai | |
| semgrep | semgrep:toplevel-fetch | AI (semgrep): POSTs to local storyboard server endpoint for agent spawn — internal IPC, not exfiltration. | ai | |
| phantom-deps | phantom-dep:zod | AI (phantom-deps): Used in config schema; phantom-dep heuristic misses config-file imports. | ai | |
| phantom-deps | phantom-dep:iconoir | AI (phantom-deps): Referenced in config files; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:ansi-to-html | AI (phantom-deps): Referenced in config files; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:html-to-image | AI (phantom-deps): Referenced in config files; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:@toon-format/toon | AI (phantom-deps): Referenced in config files; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:@radix-ui/react-visually-hidden | AI (phantom-deps): Referenced in config files; stable false positive for this package. | ai | |
| semgrep | semgrep:silent-process-exec | AI (semgrep): Detached spawn of 'npx storyboard dev' is the documented worktree dev-server feature. | ai | |
| semgrep | semgrep:env-spread | AI (semgrep): Passes process.env to spawned terminal process — required for terminal emulation functionality. | ai |
Versions (showing 44 of 44)
| Version | Deps | Published |
|---|---|---|
| 0.12.2 | 41 / 10 | |
| 0.12.1 | 41 / 10 | |
| 0.12.0 | 41 / 10 | |
| 0.11.8 | 38 / 10 | |
| 0.11.7 | 38 / 10 | |
| 0.11.6 | 38 / 10 | |
| 0.11.5 | 38 / 10 | |
| 0.11.4 | 38 / 10 | |
| 0.11.3 | 38 / 10 | |
| 0.11.2 | 38 / 10 | |
| 0.11.1 | 38 / 10 | |
| 0.11.0 | 38 / 10 | |
| 0.10.3 | 38 / 10 | |
| 0.10.2 | 38 / 10 | |
| 0.10.1 | 38 / 10 | |
| 0.10.0 | 38 / 10 | |
| 0.9.6 | 22 / 10 | |
| 0.9.5 | 22 / 10 | |
| 0.9.4 | 22 / 10 | |
| 0.9.3 | 22 / 10 | |
| 0.9.2 | 22 / 10 | |
| 0.9.1 | 22 / 10 | |
| 0.9.0 | 20 / 12 | |
| 0.8.1 | 20 / 12 | |
| 0.8.0 | 22 / 12 | |
| 0.7.1 | 22 / 12 | |
| 0.7.0 | 22 / 12 | |
| 0.6.16 | 22 / 12 | |
| 0.6.15 | 22 / 12 | |
| 0.6.14 | 22 / 12 | |
| 0.6.13 | 22 / 12 | |
| 0.6.12 | 22 / 12 | |
| 0.6.11 | 22 / 12 | |
| 0.6.10 | 22 / 12 | |
| 0.6.9 | 22 / 12 | |
| 0.6.8 | 22 / 12 | |
| 0.6.7 | 22 / 12 | |
| 0.6.6 | 22 / 12 | |
| 0.6.5 | 22 / 12 | |
| 0.6.4 | 22 / 12 | |
| 0.6.3 | 22 / 12 | |
| 0.6.2 | 22 / 12 | |
| 0.6.1 | 22 / 12 | |
| 0.6.0 | 22 / 12 |