@howells/lint
Pinned Biome and Ultracite presets for Howells projects.
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| provenance | missing-githead | AI (provenance): Minor publish-env change, no malicious indicator; trusted publisher track record. | ai | |
| phantom-deps | phantom-dep:eslint-plugin-github | AI (phantom-deps): Config-referenced lint plugin, not directly imported by design. | ai | |
| phantom-deps | phantom-dep:eslint-plugin-sonarjs | AI (phantom-deps): Config-referenced lint plugin, not directly imported by design. | ai | |
| bogus-package | bogus-package | AI (bogus-package): Internal lint preset; no repo/keywords/homepage expected for private org tooling. | ai | |
| phantom-deps | phantom-dep:oxlint-tsgolint | AI (phantom-deps): Lint preset; plugin declared for consumer use, not directly imported. | ai | |
| phantom-deps | phantom-dep:eslint | AI (phantom-deps): Lint preset declares eslint as a dep for consumers to use; not directly imported by the package itself. | ai | |
| phantom-deps | phantom-dep:eslint-plugin-boundaries | AI (phantom-deps): Config-only preset; plugin declared for consumer use, not directly imported. | ai | |
| phantom-deps | phantom-dep:eslint-import-resolver-typescript | AI (phantom-deps): Config-only preset; resolver declared for consumer use, not directly imported. | ai | |
| phantom-deps | phantom-dep:oxc-parser | AI (phantom-deps): Lint preset; oxc-parser declared for consumer toolchain, not directly imported. | ai | |
| typosquat | typosquat.levenshtein:eslint | AI (typosquat): Scoped package @howells/lint is a personal lint preset, not impersonating eslint. | ai | |
| phantom-deps | phantom-dep:ultracite | AI (phantom-deps): ultracite is a runtime dep used via bin scripts/config, not directly imported in JS. | ai | |
| typosquat | typosquat.levenshtein:pino | AI (typosquat): Scoped package @howells/lint is a personal lint preset, not impersonating pino. | ai | |
| phantom-deps | phantom-dep:@biomejs/biome | AI (phantom-deps): @biomejs/biome is a runtime dep used via bin scripts/config, not directly imported in JS. | ai |
Versions (showing 28 of 28)
| Version | Deps | Published |
|---|---|---|
| 1.1.1 | 13 / 0 | |
| 1.1.0 | 13 / 0 | |
| 1.0.0 | 12 / 0 | |
| 0.5.0 | 10 / 0 | |
| 0.4.1 | 10 / 0 | |
| 0.4.0 | 10 / 0 | |
| 0.3.2 | 10 / 0 | |
| 0.3.1 | 10 / 0 | |
| 0.3.0 | 10 / 0 | |
| 0.2.9 | 11 / 0 | |
| 0.2.8 | 11 / 0 | |
| 0.2.7 | 11 / 0 | |
| 0.2.6 | 11 / 0 | |
| 0.2.5 | 11 / 0 | |
| 0.2.4 | 11 / 0 | |
| 0.2.3 | 11 / 0 | |
| 0.2.2 | 10 / 0 | |
| 0.2.1 | 8 / 0 | |
| 0.2.0 | 8 / 0 | |
| 0.1.8 | 6 / 0 | |
| 0.1.7 | 6 / 0 | |
| 0.1.6 | 3 / 0 | |
| 0.1.5 | 3 / 0 | |
| 0.1.4 | 3 / 0 | |
| 0.1.3 | 2 / 0 | |
| 0.1.2 | 2 / 0 | |
| 0.1.1 | 2 / 0 | |
| 0.1.0 | 2 / 0 |
v1.1.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.1.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.0
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: danielhowells.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.