@ditojs/build
Dito.js is a declarative and modern web framework with a focus on API driven development, based on Koa.js, Objection.js and Vue.js
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| dependencies | unvetted-dep:postcss-inset | AI (dependencies): postcss-inset is a legitimate PostCSS plugin; stable dependency for this build tooling package. | ai | |
| typosquat | typosquat.levenshtein:esbuild | AI (typosquat): Scoped @ditojs/build is an established monorepo package, not a typosquat of esbuild. | ai | |
| semgrep | semgrep:dynamic-require | AI (semgrep): Dynamic require loads package.json files to enumerate transitive deps for rollup externals — benign build-tool pattern. | ai | |
| phantom-deps | phantom-dep:pug | AI (phantom-deps): pug is a declared dependency used indirectly via build config; phantom-dep heuristic misfires on build tools. | ai | |
| phantom-deps | phantom-dep:vue | AI (phantom-deps): vue is a declared dependency used indirectly via build config; phantom-dep heuristic misfires on build tools. | ai | |
| typosquat | typosquat.levenshtein:uuid | AI (typosquat): Scoped @ditojs/build is an established monorepo package, not a typosquat of uuid. | ai | |
| phantom-deps | phantom-dep:postcss | AI (phantom-deps): postcss is a declared dependency used indirectly via build config; phantom-dep heuristic misfires on build tools. | ai | |
| phantom-deps | phantom-dep:postcss-html | AI (phantom-deps): postcss-html is a declared dependency used indirectly via build config; phantom-dep heuristic misfires on build tools. | ai | |
| phantom-deps | phantom-dep:postcss-scss | AI (phantom-deps): postcss-scss is a declared dependency used indirectly via build config; phantom-dep heuristic misfires on build tools. | ai | |
| phantom-deps | phantom-dep:sass | AI (phantom-deps): sass is a declared dependency used indirectly via build config; phantom-dep heuristic misfires on build tools. | ai |
Versions (showing 51 of 53)
| Version | Deps | Published |
|---|---|---|
| 2.99.0 | 14 / 0 | |
| 2.97.0 | 14 / 0 | |
| 2.96.0 | 14 / 0 | |
| 2.95.0 | 14 / 0 | |
| 2.93.0 | 14 / 0 | |
| 2.92.0 | 14 / 0 | |
| 2.91.0 | 14 / 0 | |
| 2.90.0 | 14 / 0 | |
| 2.89.0 | 14 / 0 | |
| 2.88.0 | 14 / 0 | |
| 2.87.0 | 14 / 0 | |
| 2.86.0 | 14 / 0 | |
| 2.85.0 | 14 / 0 | |
| 2.84.0 | 14 / 0 | |
| 2.83.0 | 14 / 0 | |
| 2.82.0 | 14 / 0 | |
| 2.81.0 | 14 / 0 | |
| 2.80.0 | 14 / 0 | |
| 2.79.0 | 14 / 0 | |
| 2.78.0 | 14 / 0 | |
| 2.77.0 | 14 / 0 | |
| 2.75.0 | 14 / 0 | |
| 2.74.0 | 14 / 0 | |
| 2.73.0 | 14 / 0 | |
| 2.72.0 | 14 / 0 | |
| 2.71.0 | 14 / 0 | |
| 2.70.0 | 14 / 0 | |
| 2.69.0 | 14 / 0 | |
| 2.68.0 | 14 / 0 | |
| 2.67.0 | 14 / 0 | |
| 2.66.0 | 14 / 0 | |
| 2.65.0 | 14 / 0 | |
| 2.64.0 | 14 / 0 | |
| 2.63.0 | 14 / 0 | |
| 2.62.0 | 14 / 0 | |
| 2.61.0 | 14 / 0 | |
| 2.60.0 | 14 / 0 | |
| 2.59.0 | 14 / 0 | |
| 2.58.0 | 14 / 0 | |
| 2.57.0 | 14 / 0 | |
| 2.56.0 | 14 / 0 | |
| 2.55.0 | 14 / 0 | |
| 2.54.0 | 14 / 0 | |
| 2.53.0 | 14 / 0 | |
| 2.52.0 | 14 / 0 | |
| 2.51.2 | 14 / 0 | |
| 2.51.0 | 14 / 0 | |
| 2.50.0 | 14 / 0 | |
| 2.49.1 | 14 / 0 | |
| 2.49.0 | 14 / 0 | |
| 2.48.0 | 14 / 0 |
v2.99.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.96.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v2.95.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v2.93.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v2.92.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.91.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.90.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.89.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.88.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.87.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.86.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.85.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.84.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.83.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.82.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.81.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.80.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.79.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.78.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.77.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.75.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.74.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.73.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.72.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.71.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.70.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.69.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.68.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.67.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.66.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.65.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.64.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.63.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.62.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v2.61.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.60.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.59.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.58.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.57.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.56.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.55.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.54.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.53.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.52.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.51.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.51.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.50.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.49.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.49.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.48.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.