← Home

@donotdev/core

npm Repository Homepage

DoNotDev Framework - Core package with all internal modules

33
Versions
MIT
License
No
Install Scripts
Missing
Provenance

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.

Maintainers

donotdev

Keywords

donotdevdndevframeworkreacttypescriptvitenextjsi18nstate-managementzustand

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
phantom-deps phantom-dep:autoprefixer AI (phantom-deps): Config-referenced postcss plugin; stable pattern for this build-tool package. ai
phantom-deps phantom-dep:postcss-import AI (phantom-deps): Config-referenced postcss plugin; stable pattern for this build-tool package. ai
phantom-deps phantom-dep:postcss-nesting AI (phantom-deps): Config-referenced postcss plugin; stable pattern for this build-tool package. ai
phantom-deps phantom-dep:@sentry/react AI (phantom-deps): Framework config package; optional plugins declared as deps but loaded by convention. ai
phantom-deps phantom-dep:i18next-browser-languagedetector AI (phantom-deps): Framework config package; optional plugins declared as deps but loaded by convention. ai
phantom-deps phantom-dep:react-i18next AI (phantom-deps): Framework config package; optional plugins declared as deps but loaded by convention. ai
phantom-deps phantom-dep:i18next-http-backend AI (phantom-deps): Framework config package; optional plugins declared as deps but loaded by convention. ai
phantom-deps phantom-dep:vite-plugin-pwa AI (phantom-deps): Framework plugin deps loaded by convention; stable false positive for this package. ai
phantom-deps phantom-dep:vite-tsconfig-paths AI (phantom-deps): Framework plugin deps loaded by convention; stable false positive for this package. ai
phantom-deps phantom-dep:@rollup/plugin-strip AI (phantom-deps): Framework plugin deps loaded by convention; stable false positive for this package. ai
typosquat typosquat.levenshtein:cors AI (typosquat): Scoped package @donotdev/core is a framework core package, not a typosquat of cors; name collision is coincidental. ai
phantom-deps phantom-dep:@vitejs/plugin-basic-ssl AI (phantom-deps): Framework plugin deps loaded by convention; stable false positive for this package. ai
phantom-deps phantom-dep:rollup-plugin-visualizer AI (phantom-deps): Framework plugin deps loaded by convention; stable false positive for this package. ai
phantom-deps phantom-dep:@vitejs/plugin-react AI (phantom-deps): Framework plugin deps loaded by convention; stable false positive for this package. ai
semgrep semgrep:env-spread AI (semgrep): Code sample shows git worktree parsing, not env exfiltration; fires on minified bundle with no actual env spread. ai
semgrep semgrep:env-bulk-read AI (semgrep): next/index.js comment confirms it reads NEXT_PUBLIC_* vars for config injection; expected framework behavior. ai
semgrep semgrep:base64-decode AI (semgrep): Code sample shows progress tracking logic, not base64 payload execution; likely a false positive on minified code. ai
phantom-deps phantom-dep:postcss AI (phantom-deps): Framework plugin deps loaded by convention, not direct import; stable pattern for this package. ai
phantom-deps phantom-dep:fast-glob AI (phantom-deps): Framework plugin deps loaded by convention; stable false positive for this package. ai
phantom-deps phantom-dep:@clack/prompts AI (phantom-deps): Framework plugin deps loaded by convention; stable false positive for this package. ai

Versions (showing 33 of 33)

Version Deps Published
0.1.42 13 / 0
0.1.1 17 / 0
0.1.0 18 / 0
0.0.46 18 / 0
0.0.45 18 / 0
0.0.44 18 / 0
0.0.43 18 / 0
0.0.42 18 / 0
0.0.41 18 / 0
0.0.40 18 / 0
0.0.39 18 / 0
0.0.38 17 / 0
0.0.37 17 / 0
0.0.36 17 / 0
0.0.35 17 / 0
0.0.34 17 / 0
0.0.33 17 / 0
0.0.32 17 / 0
0.0.31 17 / 0
0.0.30 16 / 0
0.0.29 16 / 0
0.0.28 16 / 0
0.0.27 16 / 0
0.0.26 5 / 0
0.0.25 5 / 0
0.0.24 16 / 0
0.0.23 16 / 0
0.0.22 16 / 0
0.0.21 16 / 0
0.0.20 16 / 0
0.0.19 16 / 0
0.0.18 16 / 0
0.0.17 16 / 0

v0.1.42

3 findings
HIGH typosquat.levenshtein: Possible typosquat of 'cors' typosquat

Package name '@donotdev/core' is 1 edit(s) away from popular package 'cors'.

HIGH env-spread: vite/index.js:5 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/donotdev/core/blob/3fa4ca5febca0aaf2d14187ef88256aa870b88db/vite/index.js#L5 3 | `);if(s<0||s>=l.length)return h(e,{error:"Line out of range"},400);let c=l[s];l[s]=r?c.replace("- [ ]","- [x]"):c.replac 4 | `),{overwrite:!0}),h(e,{ok:!0,line:l[s]})}catch{h(e,{error:"Failed to update progress"},500)}}async function Ar(n,e){try > 5 | `))a.startsWith("worktree ")?(o.path&&r.push(o),o={path:a.slice(9)}):a.startsWith("HEAD ")?o.head=a.slice(5):a.startsWit 6 | `;a.writeSync(i,p)}let l=(u,p,g)=>{if(i){let f=new Date().toISOString(),d=g.length>0?" "+g.map(S=>typeof S=="object"?JSO 7 | `;a.appendFile(i,m)}},c=(u,p)=>{if(p.length===0)return u;let g=p.map(f=>typeof f=="object"?JSON.stringify(f,null,2):Stri

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.1.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.1.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.46

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.45

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.44

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.43

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.42

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.41

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.40

3 findings
HIGH typosquat.levenshtein: Possible typosquat of 'cors' typosquat

Package name '@donotdev/core' is 1 edit(s) away from popular package 'cors'.

HIGH env-spread: vite/index.js:4 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/donotdev/core/blob/7d734c4e9464b7bb1b5bc021f74732936890e451/vite/index.js#L4 2 | `)[0];e.push(o)}catch{}let s=[process.env.NVM_DIR,n.resolvePath(".nvm",t)].filter(Boolean);for(let r of s)try{let o=n.re 3 | `);if(s<0||s>=l.length)return w(e,{error:"Line out of range"},400);let u=l[s];l[s]=r?u.replace("- [ ]","- [x]"):u.replac > 4 | `),{overwrite:!0}),w(e,{ok:!0,line:l[s]})}catch{w(e,{error:"Failed to update progress"},500)}}async function sr(n,e){try 5 | `;a.writeSync(i,p)}let l=(c,p,g)=>{if(i){let d=new Date().toISOString(),m=g.length>0?" "+g.map(T=>typeof T=="object"?JSO 6 | `;a.appendFile(i,k)}},u=(c,p)=>{if(p.length===0)return c;let g=p.map(d=>typeof d=="object"?JSON.stringify(d,null,2):Stri

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.0.39

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.38

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.37

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.36

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.35

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.34

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.33

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.32

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.31

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.30

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.0.29

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.0.28

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.0.27

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.0.26

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.0.25

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.0.24

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.0.23

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.0.22

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.0.21

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.0.20

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.0.19

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.0.18

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.0.17

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.