@howells/lint
Pinned Biome and Ultracite presets for Howells projects.
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| bogus-package | bogus-package | AI (bogus-package): Internal lint preset; no repo/keywords/homepage expected for private org tooling. | ai | |
| phantom-deps | phantom-dep:oxlint-tsgolint | AI (phantom-deps): Lint preset; plugin declared for consumer use, not directly imported. | ai | |
| phantom-deps | phantom-dep:eslint | AI (phantom-deps): Lint preset declares eslint as a dep for consumers to use; not directly imported by the package itself. | ai | |
| phantom-deps | phantom-dep:eslint-plugin-boundaries | AI (phantom-deps): Config-only preset; plugin declared for consumer use, not directly imported. | ai | |
| phantom-deps | phantom-dep:eslint-import-resolver-typescript | AI (phantom-deps): Config-only preset; resolver declared for consumer use, not directly imported. | ai | |
| phantom-deps | phantom-dep:oxc-parser | AI (phantom-deps): Lint preset; oxc-parser declared for consumer toolchain, not directly imported. | ai | |
| typosquat | typosquat.levenshtein:pino | AI (typosquat): Scoped package @howells/lint is a personal lint preset, not impersonating pino. | ai | |
| phantom-deps | phantom-dep:ultracite | AI (phantom-deps): ultracite is a runtime dep used via bin scripts/config, not directly imported in JS. | ai | |
| phantom-deps | phantom-dep:@biomejs/biome | AI (phantom-deps): @biomejs/biome is a runtime dep used via bin scripts/config, not directly imported in JS. | ai | |
| typosquat | typosquat.levenshtein:eslint | AI (typosquat): Scoped package @howells/lint is a personal lint preset, not impersonating eslint. | ai |
Versions (showing 18 of 18)
| Version | Deps | Published |
|---|---|---|
| 0.2.9 | 11 / 0 | |
| 0.2.7 | 11 / 0 | |
| 0.2.6 | 11 / 0 | |
| 0.2.5 | 11 / 0 | |
| 0.2.4 | 11 / 0 | |
| 0.2.3 | 11 / 0 | |
| 0.2.2 | 10 / 0 | |
| 0.2.1 | 8 / 0 | |
| 0.2.0 | 8 / 0 | |
| 0.1.8 | 6 / 0 | |
| 0.1.7 | 6 / 0 | |
| 0.1.6 | 3 / 0 | |
| 0.1.5 | 3 / 0 | |
| 0.1.4 | 3 / 0 | |
| 0.1.3 | 2 / 0 | |
| 0.1.2 | 2 / 0 | |
| 0.1.1 | 2 / 0 | |
| 0.1.0 | 2 / 0 |
v0.2.9
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.2.7
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: danielhowells.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.2.6
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: danielhowells.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.2.5
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: danielhowells.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.2.4
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: danielhowells.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.2.3
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.2.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.2.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.2.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.1.8
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: danielhowells.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.1.7
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.1.6
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.1.5
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.1.4
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.1.3
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.1.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.1.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.1.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.