@friggframework/devtools

Supply chain provenance

Status for the latest visible version.

Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.

Maintainers

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
semgrep	semgrep:child-process-import	AI (semgrep): CLI tool that runs git/shell commands; child_process use is expected and documented.	ai	2026/04/29
semgrep	semgrep:dynamic-require	AI (semgrep): Loads user-specified integration modules by path; expected plugin-loader pattern for this CLI.	ai	2026/04/29
phantom-deps	phantom-dep:eslint	AI (phantom-deps): ESLint plugins/configs referenced via config files, not direct imports — standard shared lint tooling pattern.	ai	2026/04/29
phantom-deps	phantom-dep:eslint-plugin-json	AI (phantom-deps): ESLint plugin loaded via config file convention, not direct import.	ai	2026/04/29
phantom-deps	phantom-dep:eslint-plugin-yaml	AI (phantom-deps): ESLint plugin loaded via config file convention, not direct import.	ai	2026/04/29
phantom-deps	phantom-dep:@babel/eslint-parser	AI (phantom-deps): Loaded by ESLint config convention, not direct import.	ai	2026/04/29
phantom-deps	phantom-dep:@friggframework/test	AI (phantom-deps): Same-org scoped package used as a test helper; loaded by convention.	ai	2026/04/29
phantom-deps	phantom-dep:eslint-config-prettier	AI (phantom-deps): ESLint config referenced via config file, not direct import.	ai	2026/04/29
phantom-deps	phantom-dep:eslint-plugin-markdown	AI (phantom-deps): ESLint plugin loaded via config file convention, not direct import.	ai	2026/04/29
phantom-deps	phantom-dep:eslint-plugin-no-only-tests	AI (phantom-deps): ESLint plugin loaded via config file convention, not direct import.	ai	2026/04/29

Version	Deps	Published
1.2.2	16 / 2	2024-08-09