@earendil-works/pi-coding-agent
Supply chain provenance
Status for the latest visible version.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| npm-metadata | bundled-binaries | AI (npm-metadata): doom.wasm is an example-extension demo asset, not a runtime backdoor; stable for this package. | ai | |
| provenance | publisher-changed | AI (provenance): Transition to GitHub Actions CI/CD publisher with SLSA attestation; legitimate automation pattern for this package. | ai | |
| provenance | slsa-provenance | AI (provenance): Package consistently published via CI/CD with Sigstore attestation; publisher-changed to GitHub Actions is expected. | ai | |
| semgrep | semgrep:child-process-import | AI (semgrep): Windows toast notification helper in examples/notify.ts; execFile with fixed powershell args. | ai | |
| semgrep | semgrep:steganography-image-eval | AI (semgrep): WAD file loader in examples/doom-overlay — not runtime code, no eval of image pixel data. | ai | |
| phantom-deps | phantom-dep:marked | AI (phantom-deps): marked is a declared runtime dependency; phantom-dep heuristic false positive for this package. | ai | |
| semgrep | semgrep:new-function-constructor | AI (semgrep): Standard CJS module wrapper pattern in doom example; input is a bundled JS file, not user data. | ai | |
| semgrep | semgrep:shady-links-raw-ip | AI (semgrep): 127.0.0.1 localhost OAuth redirect URI in example code — not a C2 or exfiltration endpoint. | ai |
Versions (showing 37 of 37)
| Version | Deps | Published |
|---|---|---|
| 0.82.1 | 18 / 10 | |
| 0.82.0 | 18 / 10 | |
| 0.81.1 | 18 / 10 | |
| 0.81.0 | 18 / 10 | |
| 0.80.10 | 18 / 10 | |
| 0.80.9 | 18 / 10 | |
| 0.80.8 | 18 / 10 | |
| 0.80.7 | 18 / 10 | |
| 0.80.6 | 18 / 10 | |
| 0.80.5 | 18 / 10 | |
| 0.80.3 | 18 / 10 | |
| 0.80.2 | 18 / 10 | |
| 0.80.1 | 18 / 10 | |
| 0.79.10 | 18 / 10 | |
| 0.79.9 | 18 / 10 | |
| 0.79.8 | 18 / 10 | |
| 0.79.7 | 18 / 10 | |
| 0.79.6 | 18 / 10 | |
| 0.79.5 | 18 / 10 | |
| 0.79.4 | 18 / 10 | |
| 0.79.3 | 17 / 9 | |
| 0.79.2 | 17 / 9 | |
| 0.79.1 | 17 / 9 | |
| 0.79.0 | 17 / 9 | |
| 0.78.1 | 17 / 9 | |
| 0.78.0 | 17 / 9 | |
| 0.77.0 | 17 / 9 | |
| 0.76.0 | 17 / 9 | |
| 0.75.5 | 17 / 9 | |
| 0.75.4 | 17 / 9 | |
| 0.75.3 | 17 / 9 | |
| 0.75.2 | 17 / 9 | |
| 0.75.1 | 16 / 8 | |
| 0.75.0 | 16 / 8 | |
| 0.74.2 | 16 / 8 | |
| 0.74.1 | 16 / 8 | |
| 0.74.0 | 21 / 8 |
v0.82.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.82.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.81.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.81.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.80.10
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.80.9
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.80.8
2 findingsPackage contains compiled binaries that could be backdoors: • examples/extensions/doom-overlay/doom/build/doom.wasm
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.80.7
2 findingsPackage contains compiled binaries that could be backdoors: • examples/extensions/doom-overlay/doom/build/doom.wasm
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.80.6
2 findingsPackage contains compiled binaries that could be backdoors: • examples/extensions/doom-overlay/doom/build/doom.wasm
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.80.5
2 findingsPackage contains compiled binaries that could be backdoors: • examples/extensions/doom-overlay/doom/build/doom.wasm
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.80.3
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.