@goldstack/template-hetzner-vps
Utilities for packages that help provision Hetzner Servers
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| dependencies | unvetted-dep:@goldstack/infra | AI (dependencies): Same-org monorepo dependency; not an independent supply-chain risk. | ai | |
| dependencies | unvetted-dep:@goldstack/infra-aws | AI (dependencies): Same-org monorepo dependency; not an independent supply-chain risk. | ai | |
| dependencies | unvetted-dep:@goldstack/utils-cli | AI (dependencies): Same-org monorepo dependency; not an independent supply-chain risk. | ai | |
| dependencies | unvetted-dep:@goldstack/infra-hetzner | AI (dependencies): Same-org monorepo dependency; not an independent supply-chain risk. | ai | |
| dependencies | unvetted-dep:@goldstack/utils-esbuild | AI (dependencies): Same-org monorepo dependency; not an independent supply-chain risk. | ai | |
| dependencies | unvetted-dep:@goldstack/utils-package | AI (dependencies): Same-org monorepo dependency; not an independent supply-chain risk. | ai | |
| dependencies | unvetted-dep:@goldstack/utils-package-config-embedded | AI (dependencies): Same-org monorepo dependency; not an independent supply-chain risk. | ai | |
| phantom-deps | phantom-dep:uuid | AI (phantom-deps): Declared in dependencies; likely used transitively or in config — stable false positive for this package. | ai | |
| provenance | no-provenance | AI (provenance): Established monorepo package; lack of provenance is common and not a disqualifier here. | ai | |
| phantom-deps | phantom-dep:@aws-sdk/types | AI (phantom-deps): Framework-scoped AWS SDK type package; loaded by convention, not direct import. | ai | |
| phantom-deps | phantom-dep:@goldstack/utils-cli | AI (phantom-deps): Same-org monorepo dep; phantom detection is a stable false positive here. | ai | |
| phantom-deps | phantom-dep:@goldstack/utils-esbuild | AI (phantom-deps): Same-org monorepo dep; phantom detection is a stable false positive here. | ai | |
| phantom-deps | phantom-dep:@aws-sdk/credential-providers | AI (phantom-deps): Framework-scoped AWS SDK package; loaded by convention, not direct import. | ai | |
| phantom-deps | phantom-dep:@goldstack/utils-terraform-aws | AI (phantom-deps): Same-org monorepo dep; phantom detection is a stable false positive here. | ai | |
| phantom-deps | phantom-dep:@goldstack/utils-package-config-embedded | AI (phantom-deps): Same-org monorepo dep; phantom detection is a stable false positive here. | ai |
Versions (showing 17 of 17)
| Version | Deps | Published |
|---|---|---|
| 0.1.73 | 12 / 10 | |
| 0.1.72 | 12 / 10 | |
| 0.1.70 | 12 / 10 | |
| 0.1.68 | 12 / 10 | |
| 0.1.67 | 12 / 10 | |
| 0.1.64 | 12 / 10 | |
| 0.1.60 | 12 / 10 | |
| 0.1.58 | 12 / 10 | |
| 0.1.50 | 12 / 11 | |
| 0.1.44 | 12 / 11 | |
| 0.1.42 | 12 / 11 | |
| 0.1.40 | 12 / 11 | |
| 0.1.39 | 12 / 11 | |
| 0.1.38 | 12 / 11 | |
| 0.1.37 | 12 / 11 | |
| 0.1.33 | 12 / 11 | |
| 0.1.32 | 12 / 11 |
v0.1.73
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.1.72
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.1.70
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.1.68
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.1.67
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.1.64
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.1.60
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.1.58
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.1.50
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.1.44
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.1.42
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.1.40
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.1.39
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.1.38
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.1.37
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.1.33
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.1.32
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.