@graphql-yoga/typed-event-target
This is an internal package. Please don't use this package directly. The package will do unexpected breaking changes.
8
Versions
MIT
License
No
Install Scripts
Verified
Provenance
Supply chain provenance
Status for the latest visible version.
SLSA provenance attestation
npm registry signatures
No source commit
Maintainers
urigodotansimhakamilkisielawittydeveloper
Keywords
pubsubgraphqleventsubscription
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| provenance | missing-githead | AI (provenance): Package has SLSA provenance attestation via Sigstore, which supersedes gitHead as a supply chain integrity signal. Missing gitHead is a pipeline change, not a security concern for this well-established package. | ai | |
| phantom-deps | phantom-dep:tslib | AI (phantom-deps): tslib is a standard TypeScript runtime helper dependency; its indirect import pattern is expected in compiled TypeScript packages. | ai | |
| phantom-deps | phantom-dep:@repeaterjs/repeater | AI (phantom-deps): Referenced in config files as documented; legitimate dependency for this event-target/pubsub utility package. | ai | |
| bogus-package | bogus-package | AI (bogus-package): Short README and empty CJS entry are consistent with a TypeScript-first monorepo scoped package. Not indicative of spam or malicious intent for this established graphql-yoga package. | ai |