@knapsack/rollup-config-starter
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| provenance | no-provenance | AI (provenance): Provenance attestation is a best-practice signal, not a security blocker for established packages. | ai | |
| dependencies | unvetted-dep:rollup-plugin-sass | AI (dependencies): Standard rollup SASS plugin; expected in a rollup config starter. | ai | |
| dependencies | unvetted-dep:node-sass-magic-importer | AI (dependencies): Known SASS importer utility; appropriate for this package's purpose. | ai | |
| dependencies | unvetted-dep:rollup-plugin-polyfill-node | AI (dependencies): Standard rollup node polyfill plugin; expected in a rollup config starter. | ai | |
| dependencies | unvetted-dep:svgo | AI (dependencies): svgo is a well-known SVG optimizer; legitimate dependency for a rollup config package. | ai | |
| phantom-deps | phantom-dep:tslib | AI (phantom-deps): tslib is a known implicit TypeScript runtime dep; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:@rollup/plugin-babel | AI (phantom-deps): Framework-scoped plugin loaded by convention in rollup config; stable false positive. | ai | |
| phantom-deps | phantom-dep:rollup-plugin-polyfill-node | AI (phantom-deps): Referenced in config files but not directly imported; stable false positive for this rollup config package. | ai | |
| npm-metadata | no-description | AI (npm-metadata): Intentionally empty description for internal config package; stable pattern across 8484 versions. | ai | |
| bogus-package | bogus-package | AI (bogus-package): Internal monorepo tooling package; sparse README/description is expected for org-internal config starters. | ai |
Versions (showing 18 of 18)
| Version | Deps | Published |
|---|---|---|
| 4.93.0 | 19 / 4 | |
| 4.92.24 | 19 / 4 | |
| 4.92.23 | 19 / 4 | |
| 4.92.22 | 19 / 4 | |
| 4.92.21 | 19 / 4 | |
| 4.92.20 | 19 / 4 | |
| 4.92.18 | 19 / 4 | |
| 4.92.17 | 19 / 4 | |
| 4.92.15 | 19 / 4 | |
| 4.92.13 | 19 / 4 | |
| 4.92.11 | 19 / 4 | |
| 4.92.10 | 19 / 4 | |
| 4.92.9 | 19 / 4 | |
| 4.92.8 | 19 / 4 | |
| 4.92.7 | 19 / 4 | |
| 4.92.6 | 19 / 4 | |
| 4.92.4 | 19 / 4 | |
| 4.92.3 | 19 / 4 |
v4.93.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.92.24
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.92.23
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.92.22
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.92.21
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.92.20
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.