@microsoft/spfx-heft-plugins
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| maintainer-change | maintainer-added | AI (maintainer-change): microsoft-oss-releases is Microsoft's standard OSS release automation account; not a suspicious addition. | ai | |
| dependencies | unvetted-dep:@microsoft/rush-lib | AI (dependencies): First-party Microsoft Rush monorepo tool; consistent with SPFx build tooling context across all versions. | ai | |
| dependencies | unvetted-dep:@rushstack/heft-config-file | AI (dependencies): Rush Stack package from same Microsoft org; consistent with SPFx build tooling. | ai | |
| dependencies | unvetted-dep:@rushstack/module-minifier | AI (dependencies): Rush Stack package from same Microsoft org; consistent with SPFx build tooling. | ai | |
| dependencies | unvetted-dep:@rushstack/localization-utilities | AI (dependencies): Rush Stack package from same Microsoft org; consistent with SPFx build tooling. | ai | |
| dependencies | unvetted-dep:@rushstack/webpack5-localization-plugin | AI (dependencies): Rush Stack package from same Microsoft org; consistent with SPFx build tooling. | ai | |
| dependencies | unvetted-dep:@rushstack/set-webpack-public-path-plugin | AI (dependencies): Rush Stack package from same Microsoft org; consistent with SPFx build tooling. | ai | |
| dependencies | unvetted-dep:@rushstack/webpack5-module-minifier-plugin | AI (dependencies): Rush Stack package from same Microsoft org; consistent with SPFx build tooling. | ai | |
| dependencies | unvetted-dep:mem-fs-editor | AI (dependencies): Standard file-system utility; used in many Microsoft build tooling packages. | ai | |
| phantom-deps | phantom-dep:html-loader | AI (phantom-deps): html-loader is a declared runtime dependency; phantom-dep is a false positive here. | ai | |
| phantom-deps | phantom-dep:source-map-loader | AI (phantom-deps): source-map-loader is a declared runtime dependency; phantom-dep is a false positive here. | ai | |
| phantom-deps | phantom-dep:source-map | AI (phantom-deps): source-map is a declared runtime dependency; phantom-dep is a false positive here. | ai | |
| semgrep | semgrep:dynamic-require | AI (semgrep): Dynamic require is used to load user-supplied webpack customization scripts — documented plugin pattern for this SPFx build tool. | ai | |
| phantom-deps | phantom-dep:@types/tapable | AI (phantom-deps): Framework-scoped types package; stable false positive for this build tooling package. | ai |
Versions (showing 5 of 5)
| Version | Deps | Published |
|---|---|---|
| 1.23.0 | 28 / 28 | |
| 1.22.2 | 30 / 29 | |
| 1.22.1 | 30 / 29 | |
| 1.22.0 | 30 / 29 | |
| 1.21.1 | 29 / 13 |
v1.23.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.22.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.22.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.21.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.