← Home

@dxos/plugin-template

npm Repository Homepage

Template for new plugin

24
Versions
MIT
License
No
Install Scripts
Verified
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures No source commit

Maintainers

richburdonmarik_dwittjosiahdxos-botmykola-vrmchk

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
dependencies unvetted-dep:@dxos/react-client AI (dependencies): Same-org monorepo sibling package, pinned version. ai
provenance publisher-changed AI (provenance): dxos-bot → GitHub Actions is a CI pipeline migration within the same org; SLSA attestation confirms build integrity. ai
maintainer-change maintainer-removed AI (maintainer-change): Maintainer removal consistent with org-level CI automation takeover of publishing; SLSA provenance confirms legitimate CI build. ai
publish-pattern new-deps-added AI (publish-pattern): All new deps are @dxos/* scoped at matching 0.9.0 version — coordinated monorepo release, not injection. ai
phantom-deps phantom-dep:@dxos/plugin-client AI (phantom-deps): Same-org scoped dep; phantom-dep heuristic unreliable for monorepo packages with complex import maps. ai
phantom-deps phantom-dep:@dxos/echo AI (phantom-deps): Monorepo template; same-org deps may be indirect/re-exported, not directly imported. ai
bogus-package bogus-package AI (bogus-package): Monorepo template package; sparse README is expected for internal scaffolding, not spam. ai
phantom-deps phantom-dep:@dxos/async AI (phantom-deps): Same-org monorepo dep; phantom detection is a heuristic false positive here. ai
phantom-deps phantom-dep:@dxos/plugin-graph AI (phantom-deps): Same-org monorepo dep; phantom detection is a heuristic false positive here. ai
phantom-deps phantom-dep:@preact/signals-core AI (phantom-deps): Referenced in config files; legitimate transitive/config usage in monorepo build. ai

Versions (showing 24 of 24)

Version Deps Published
0.9.0 9 / 9
0.8.3 12 / 9
0.8.2 12 / 9
0.7.4 7 / 9
0.7.1 7 / 9
0.6.13 7 / 9
0.6.11 7 / 9
0.6.9 7 / 9
0.6.8 7 / 9
0.6.7 4 / 9
0.6.6 4 / 9
0.6.5 4 / 9
0.6.4 4 / 9
0.6.3 4 / 9
0.6.2 4 / 9
0.6.1 4 / 9
0.6.0 4 / 9
0.5.8 4 / 9
0.5.7 4 / 9
0.5.6 4 / 9
0.5.5 4 / 9
0.5.4 4 / 9
0.5.3 4 / 9
0.5.2 4 / 9

v0.7.4

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.7.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.6.13

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.6.11

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.6.9

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.6.8

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.6.7

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.6.6

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.6.5

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.6.4

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.6.3

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.6.2

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.6.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.6.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.5.8

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.5.7

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.5.6

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.5.5

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.5.4

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.5.3

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.5.2

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.