@eforge-build/eforge
Autonomous plan-build-review CLI for code generation
33
Versions
Apache-2.0
License
No
Install Scripts
Verified
Provenance
Supply chain provenance
Status for the latest visible version.
SLSA provenance attestation
npm registry signatures
No source commit
Maintainers
schaakesolutions
Keywords
aiagentcode-generationclaude
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| publish-pattern | new-deps-added | AI (publish-pattern): New dep is a same-org sibling at matching version (0.7.20); consistent with monorepo split, not a suspicious third-party dep. | ai | |
| provenance | publisher-changed | AI (provenance): Transition from manual publish to GitHub Actions CI/CD with SLSA provenance; consistent with legitimate automation adoption. | ai | |
| source-diff | obfuscated-file:node_modules/@eforge-build/monitor/dist/monitor-ui/assets/actionscript-3-Cj-0sM4g.js | AI (source-diff): Minified Shiki language grammar JSON asset; not obfuscated malware. | ai | |
| source-diff | obfuscated-file:node_modules/@eforge-build/monitor/dist/monitor-ui/assets/ada-DhEA_nP5.js | AI (source-diff): Minified Shiki language grammar JSON asset; not obfuscated malware. | ai | |
| source-diff | obfuscated-file:node_modules/@eforge-build/monitor/dist/monitor-ui/assets/andromeeda-CWmR-N6V.js | AI (source-diff): Minified Shiki theme JSON asset; not obfuscated malware. | ai | |
| source-diff | obfuscated-file:node_modules/@eforge-build/monitor/dist/monitor-ui/assets/angular-ts-Kcd22Ido.js | AI (source-diff): Minified Shiki language grammar JSON asset; not obfuscated malware. | ai | |
| source-diff | obfuscated-file:node_modules/@eforge-build/monitor/dist/monitor-ui/assets/apache-D5R2GKIs.js | AI (source-diff): Minified Shiki language grammar JSON asset; not obfuscated malware. | ai | |
| source-diff | obfuscated-file:node_modules/@eforge-build/monitor/dist/monitor-ui/assets/apex-Qu8W4hal.js | AI (source-diff): Minified Shiki language grammar JSON asset; not obfuscated malware. | ai | |
| source-diff | obfuscated-file:node_modules/@eforge-build/monitor/dist/monitor-ui/assets/blade-C4ts2lca.js | AI (source-diff): Minified Shiki language grammar JSON asset; not obfuscated malware. | ai | |
| source-diff | obfuscated-file:node_modules/@eforge-build/monitor/dist/monitor-ui/assets/angular-html-BZJbgpOD.js | AI (source-diff): Minified Shiki language grammar JSON asset; not obfuscated malware. | ai | |
| source-diff | obfuscated-file:node_modules/@eforge-build/monitor/dist/monitor-ui/assets/abap-BRbAAyvE.js | AI (source-diff): Minified Shiki language grammar JSON asset; not obfuscated malware. | ai | |
| source-diff | net-exec-file:node_modules/@eforge-build/monitor/dist/monitor-ui/assets/blade-C4ts2lca.js | AI (source-diff): Minified Vite UI asset containing language grammar JSON; no actual network fetch or dynamic exec payload. | ai | |
| source-diff | large-new-source-files | AI (source-diff): Large file count is expected: bundled shiki syntax-highlighting assets for monitor UI. | ai |
Versions (showing 33 of 33)
| Version | Deps | Published |
|---|---|---|
| 0.8.1 | 10 / 3 | |
| 0.7.21 | 10 / 3 | |
| 0.7.20 | 10 / 3 | |
| 0.7.12 | 9 / 3 | |
| 0.7.11 | 9 / 3 | |
| 0.7.10 | 9 / 3 | |
| 0.7.9 | 9 / 3 | |
| 0.7.8 | 9 / 3 | |
| 0.7.7 | 9 / 3 | |
| 0.7.6 | 9 / 3 | |
| 0.7.4 | 9 / 3 | |
| 0.7.3 | 9 / 3 | |
| 0.7.2 | 9 / 3 | |
| 0.7.1 | 9 / 3 | |
| 0.7.0 | 9 / 3 | |
| 0.6.2 | 9 / 3 | |
| 0.6.0 | 9 / 3 | |
| 0.5.12 | 9 / 3 | |
| 0.5.11 | 9 / 3 | |
| 0.5.10 | 9 / 3 | |
| 0.5.9 | 9 / 3 | |
| 0.5.8 | 9 / 3 | |
| 0.5.6 | 9 / 3 | |
| 0.5.5 | 9 / 3 | |
| 0.5.4 | 9 / 3 | |
| 0.5.3 | 9 / 3 | |
| 0.5.2 | 9 / 3 | |
| 0.5.1 | 9 / 3 | |
| 0.5.0 | 9 / 3 | |
| 0.4.3 | 9 / 3 | |
| 0.4.2 | 9 / 3 | |
| 0.4.1 | 9 / 3 | |
| 0.4.0 | 9 / 3 |
v0.8.1
1 finding
INFO
Has SLSA provenance attestation
provenance
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.