@kosdev-code/kos-nx-plugin
Nx plugin providing generators and executors for KOS UI application development.
15
Versions
—
License
Yes
Install Scripts
Missing
Provenance
Supply chain provenance
Status for the latest visible version.
No SLSA provenance
npm registry signatures
gitHead linked
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
kosdevmatrica_mark
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | large-new-source-files | AI (source-diff): New files are generator scaffold templates and assets, not injected code. | ai | |
| publish-pattern | new-deps-added | AI (publish-pattern): New dep is same-org @kosdev-code/kos-codegen-core at matching major version; consistent with coordinated release. | ai | |
| bogus-package | bogus-package | AI (bogus-package): NX plugins conventionally use generators.json/migrations.json as entry points; empty main and missing metadata are structural, not spam indicators, for this package type. | ai | |
| dependencies | unvetted-dep:@nx/devkit | AI (dependencies): @nx/devkit is the core NX plugin API; its presence in an NX plugin is expected and benign across all versions. | ai | |
| dependencies | unvetted-dep:@nx/react | AI (dependencies): @nx/react is a standard NX ecosystem package; its presence in an NX plugin is expected and benign across all versions. | ai | |
| install-scripts | install-script:postinstall | AI (install-scripts): The postinstall script is an empty string — it is a no-op and executes nothing. This is a stable false positive for this package. | ai | |
| semgrep | semgrep:child-process-import | AI (semgrep): child_process is used solely to locate Java home directory — standard practice for build plugins interacting with Java tooling. No user-controlled input or arbitrary execution. | ai | |
| semgrep | semgrep:shady-links-raw-ip | AI (semgrep): The raw IP is 127.0.0.1 (localhost), used as a local dev server host in a generator config. No exfiltration risk; stable false positive for this build plugin. | ai |
Versions (showing 15 of 15)
| Version | Deps | Published |
|---|---|---|
| 3.0.10 | 3 / 0 | |
| 3.0.8 | 3 / 0 | |
| 3.0.3 | 3 / 0 | |
| 3.0.0 | 3 / 0 | |
| 2.1.40 | 2 / 0 | |
| 2.1.38 | 2 / 0 | |
| 2.1.30 | 2 / 0 | |
| 2.1.23 | 2 / 0 | |
| 2.1.22 | 2 / 0 | |
| 2.0.46 | 2 / 0 | |
| 2.0.45 | 2 / 0 | |
| 2.0.43 | 2 / 0 | |
| 2.0.28 | 2 / 0 | |
| 2.0.12 | 2 / 0 | |
| 2.0.6 | 2 / 0 |
v3.0.10
1 finding
LOW
No provenance attestation
provenance
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.0.8
1 finding
LOW
No provenance attestation
provenance
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.0.0
1 finding
LOW
No provenance attestation
provenance
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.