@module-federation/node
Supply chain provenance
Status for the latest visible version.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| phantom-deps | phantom-dep:node-fetch | AI (phantom-deps): Common dep likely used in bundled dist code not scanned for imports. | ai | |
| phantom-deps | phantom-dep:@module-federation/utilities | AI (phantom-deps): Same-org sibling package, expected phantom in monorepo. | ai | |
| phantom-deps | phantom-dep:@module-federation/enhanced | AI (phantom-deps): Same-org sibling package, expected phantom in monorepo. | ai | |
| phantom-deps | phantom-dep:@module-federation/runtime | AI (phantom-deps): Same-org sibling package, expected phantom in monorepo. | ai | |
| phantom-deps | phantom-dep:@module-federation/sdk | AI (phantom-deps): Same-org sibling package, expected phantom in monorepo. | ai | |
| provenance | publisher-changed | AI (provenance): Transition to GitHub Actions CI publishing with SLSA provenance; consistent with monorepo CI/CD automation for this org. | ai | |
| source-diff | net-exec-file:dist/src/filesystem/stratagies.mjs | AI (source-diff): Legitimate chunk-loading strategies (vm.runInThisContext for local files, fetch for remote chunks) — core MF Node functionality. | ai | |
| source-diff | net-exec-file:dist/src/utils/hot-reload.mjs | AI (source-diff): HMR utility using eval('require') as webpack compat fallback; expected pattern for this package. | ai | |
| source-diff | net-exec-file:dist/src/utils/flush-chunks.mjs | AI (source-diff): Core MF federation state introspection; new Function used to access globalThis, not arbitrary remote code execution. | ai | |
| typosquat | typosquat.levenshtein:zod | AI (typosquat): Scoped package @module-federation/node is not a typosquat of zod; Levenshtein match is a false positive. | ai | |
| phantom-deps | phantom-dep:encoding | AI (phantom-deps): encoding is a declared runtime dep used transitively by node-fetch; stable false positive for this package. | ai |
Versions (showing 51 of 150)
| Version | Deps | Published |
|---|---|---|
| 2.7.47 | 6 / 1 | |
| 2.7.46 | 6 / 1 | |
| 2.7.45 | 6 / 0 | |
| 2.7.44 | 6 / 0 | |
| 2.7.43 | 6 / 0 | |
| 2.7.42 | 6 / 0 | |
| 2.7.41 | 6 / 0 | |
| 2.7.40 | 6 / 0 | |
| 2.7.39 | 6 / 0 | |
| 2.7.38 | 7 / 0 | |
| 2.7.37 | 7 / 0 | |
| 2.7.36 | 7 / 0 | |
| 2.7.35 | 7 / 0 | |
| 2.7.34 | 6 / 0 | |
| 2.7.33 | 6 / 0 | |
| 2.7.32 | 6 / 0 | |
| 2.7.31 | 6 / 0 | |
| 2.7.30 | 6 / 0 | |
| 2.7.29 | 6 / 0 | |
| 2.7.28 | 6 / 0 | |
| 2.7.27 | 6 / 0 | |
| 2.7.26 | 6 / 0 | |
| 2.7.25 | 6 / 0 | |
| 2.7.24 | 6 / 0 | |
| 2.7.23 | 6 / 0 | |
| 2.7.22 | 6 / 0 | |
| 2.7.21 | 6 / 0 | |
| 2.7.20 | 6 / 0 | |
| 2.7.19 | 6 / 0 | |
| 2.7.18 | 6 / 0 | |
| 2.7.17 | 6 / 0 | |
| 2.7.16 | 6 / 0 | |
| 2.7.15 | 6 / 0 | |
| 2.7.14 | 6 / 0 | |
| 2.7.13 | 6 / 0 | |
| 2.7.12 | 6 / 0 | |
| 2.7.11 | 6 / 0 | |
| 2.7.10 | 6 / 0 | |
| 2.7.9 | 6 / 0 | |
| 2.7.8 | 6 / 0 | |
| 2.7.7 | 6 / 0 | |
| 2.7.6 | 6 / 0 | |
| 2.7.5 | 6 / 0 | |
| 2.7.4 | 6 / 0 | |
| 2.7.3 | 6 / 0 | |
| 2.7.2 | 6 / 0 | |
| 2.7.1 | 7 / 0 | |
| 2.7.0 | 7 / 0 | |
| 2.6.33 | 7 / 0 | |
| 2.6.32 | 7 / 0 | |
| 2.6.31 | 7 / 0 |
v2.7.47
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v2.7.46
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v2.7.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.7.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.6.33
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.6.32
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.6.31
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.