@dxos/index-core
Indexing core.
2
Versions
MIT
License
No
Install Scripts
Verified
Provenance
Supply chain provenance
Status for the latest visible version.
SLSA provenance attestation
npm registry signatures
No source commit
Maintainers
richburdonmarik_dwittjosiahdxos-botmykola-vrmchk
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| provenance | publisher-changed | AI (provenance): Transition from human publisher to GitHub Actions CI with SLSA attestation is a legitimate automation pattern for this monorepo. | ai | |
| maintainer-change | maintainer-removed | AI (maintainer-change): Maintainer removal consistent with org-level CI/CD automation takeover; SLSA attestation confirms legitimate pipeline. | ai | |
| phantom-deps | phantom-dep:@dxos/async | AI (phantom-deps): Monorepo sibling dep; phantom-dep heuristic unreliable for workspace packages. | ai | |
| phantom-deps | phantom-dep:@dxos/debug | AI (phantom-deps): Monorepo sibling dep; phantom-dep heuristic unreliable for workspace packages. | ai | |
| phantom-deps | phantom-dep:@dxos/effect | AI (phantom-deps): Monorepo sibling dep; phantom-dep heuristic unreliable for workspace packages. | ai | |
| npm-metadata | suspicious-initial-version | AI (npm-metadata): DXOS monorepo publishes all packages at 0.0.0 as workspace version; not a throwaway package. | ai | |
| phantom-deps | phantom-dep:@effect/cli | AI (phantom-deps): Referenced in config files; false positive for this package's build setup. | ai | |
| phantom-deps | phantom-dep:@effect/platform | AI (phantom-deps): Referenced in config files; false positive for this package's build setup. | ai | |
| phantom-deps | phantom-dep:@effect/experimental | AI (phantom-deps): Referenced in config files; false positive for this package's build setup. | ai | |
| phantom-deps | phantom-dep:@dxos/context | AI (phantom-deps): Monorepo sibling dep; phantom-dep heuristic unreliable for workspace packages. | ai | |
| phantom-deps | phantom-dep:@dxos/log | AI (phantom-deps): Monorepo sibling dep; phantom-dep heuristic unreliable for workspace packages. | ai |