@genesislcap/uvu-playwright-builder
UVU/Playwright builder
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| publish-pattern | rapid-publish | AI (publish-pattern): Large monorepo with automated CI; rapid publishes are expected across coordinated package releases. | ai | |
| dependencies | unvetted-dep:tsm | AI (dependencies): tsm is a well-known TypeScript module loader used as test tooling; stable false positive for this package. | ai | |
| dependencies | unvetted-dep:playwright-test | AI (dependencies): playwright-test is a legitimate test tooling dependency used throughout this package's ecosystem. | ai | |
| phantom-deps | phantom-dep:tsm | AI (phantom-deps): tsm is a declared dep used via config/CLI, not directly imported; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:uvu | AI (phantom-deps): Test runner invoked via CLI, not imported directly; expected for this builder package. | ai | |
| phantom-deps | phantom-dep:watchlist | AI (phantom-deps): CLI tool used in build scripts, not imported directly; expected pattern. | ai | |
| semgrep | semgrep:env-spread | AI (semgrep): Test runner builder intentionally forwards process.env to subprocess; standard pattern for CLI build tools. | ai | |
| phantom-deps | phantom-dep:playwright-test | AI (phantom-deps): Playwright test runner invoked via npx subprocess, not imported directly; expected for this builder. | ai | |
| phantom-deps | phantom-dep:yoctocolors | AI (phantom-deps): Utility referenced in config/scripts context, stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:c8 | AI (phantom-deps): Coverage tool referenced in config files, not imported directly; expected usage pattern. | ai | |
| phantom-deps | phantom-dep:nyc | AI (phantom-deps): Coverage tool referenced in config files, not imported directly; expected usage pattern. | ai | |
| phantom-deps | phantom-dep:tsx | AI (phantom-deps): CLI tool invoked via subprocess, not imported; expected for build tooling. | ai |
Versions (showing 51 of 198)
| Version | Deps | Published |
|---|---|---|
| 14.447.2 | 9 / 1 | |
| 14.447.0 | 9 / 1 | |
| 14.445.1 | 9 / 1 | |
| 14.445.0 | 9 / 1 | |
| 14.444.1 | 9 / 1 | |
| 14.444.0 | 9 / 1 | |
| 14.443.1 | 9 / 1 | |
| 14.443.0 | 9 / 1 | |
| 14.442.0 | 9 / 1 | |
| 14.441.0 | 9 / 1 | |
| 14.439.3 | 9 / 1 | |
| 14.439.2 | 9 / 1 | |
| 14.439.1 | 9 / 1 | |
| 14.439.0 | 9 / 1 | |
| 14.438.1 | 9 / 1 | |
| 14.438.0 | 9 / 1 | |
| 14.437.6 | 9 / 1 | |
| 14.437.5 | 9 / 1 | |
| 14.437.3 | 9 / 1 | |
| 14.437.2 | 9 / 1 | |
| 14.437.1 | 9 / 1 | |
| 14.436.0 | 9 / 1 | |
| 14.435.0 | 9 / 1 | |
| 14.434.0 | 9 / 1 | |
| 14.433.1 | 9 / 1 | |
| 14.432.2 | 9 / 1 | |
| 14.432.1 | 9 / 1 | |
| 14.432.0 | 9 / 1 | |
| 14.431.0 | 9 / 1 | |
| 14.430.2 | 9 / 1 | |
| 14.430.1 | 9 / 1 | |
| 14.430.0 | 9 / 1 | |
| 14.429.3 | 9 / 1 | |
| 14.429.2 | 9 / 1 | |
| 14.429.1 | 9 / 1 | |
| 14.429.0 | 9 / 1 | |
| 14.428.1 | 9 / 1 | |
| 14.428.0 | 9 / 1 | |
| 14.427.1 | 9 / 1 | |
| 14.427.0 | 9 / 1 | |
| 14.426.0 | 9 / 1 | |
| 14.424.1 | 9 / 1 | |
| 14.424.0 | 9 / 1 | |
| 14.423.0 | 9 / 1 | |
| 14.422.1 | 9 / 1 | |
| 14.422.0 | 9 / 1 | |
| 14.421.0 | 9 / 1 | |
| 14.420.0 | 9 / 1 | |
| 14.419.2 | 9 / 1 | |
| 14.419.1 | 9 / 1 | |
| 14.419.0 | 9 / 1 |
v14.447.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v14.447.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v14.445.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v14.445.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v14.444.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v14.444.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v14.443.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v14.443.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v14.442.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v14.441.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v14.439.3
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v14.439.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v14.439.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v14.439.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v14.438.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v14.438.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v14.437.6
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v14.437.5
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v14.437.3
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v14.437.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v14.437.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v14.436.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v14.435.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v14.434.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v14.433.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v14.432.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v14.432.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v14.432.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v14.431.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v14.430.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v14.430.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v14.430.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v14.429.3
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v14.429.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v14.429.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v14.429.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v14.428.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v14.428.0
2 findingsSpreading entire process.env into an object — may capture all secrets Source: https://github.com/genesislcap/foundation-ui/blob/e43acca8a6393d0f3d243d4fd3625457c9b6a8e7/src/index.ts#L28 26 | run(cwd, `npx playwright test --config=./playwright.config.ts ${uiParam} ${debugParam}`, { 27 | prefixCommandWithNode: false, > 28 | env: { 29 | ...process.env, 30 | PORT: pkg.config?.PORT,
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v14.427.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v14.427.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v14.426.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v14.424.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v14.424.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v14.423.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v14.422.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v14.422.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v14.421.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v14.420.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v14.419.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v14.419.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v14.419.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.