← Home

@effect/platform-node-shared

npm Repository Homepage

Unified interfaces for common platform-specific services

3
Versions
MIT
License
No
Install Scripts
Verified
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures No source commit

Maintainers

schicklingmichael.arnaldieffect-bot

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
provenance publisher-changed AI (provenance): Effect-TS migrated from personal npm publishing (michael.arnaldi) to GitHub Actions CI/CD with SLSA provenance attestation — a security improvement, not a compromise signal. ai
publish-pattern dormant-publish AI (publish-pattern): Package has 471 versions and is actively maintained; the dormancy gap is a registry artifact, not indicative of account takeover. SLSA provenance further confirms legitimate CI publishing. ai
semgrep semgrep:env-spread AI (semgrep): Spreading process.env into child_process options is the standard pattern for a command executor passing environment to subprocesses. No exfiltration; stable false positive for this package. ai
bogus-package bogus-package AI (bogus-package): Part of the well-established Effect-TS monorepo with 471 versions. Short README and missing keywords are cosmetic; not a spam or low-value package. ai

Versions (showing 3 of 103)

Version Deps Published
0.31.5 3 / 0
0.31.4 3 / 0
0.31.3 3 / 0

v0.31.5

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.31.4

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.31.3

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.