@nocobase/build — Greenflagged

Library build tool based on rollup.

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.

Maintainers

chenosjiannlu

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
dependencies	unvetted-dep:@rsdoctor/rspack-plugin	AI (dependencies): Official Rsdoctor plugin for Rspack bundle analysis; legitimate build tooling dependency from ByteDance/web-infra-dev.	ai	2026/04/27
dependencies	unvetted-dep:vite-plugin-css-injected-by-js	AI (dependencies): Well-known Vite plugin for CSS injection; legitimate build tooling dependency.	ai	2026/04/27
dependencies	unvetted-dep:vite-plugin-lib-inject-css	AI (dependencies): Well-known Vite plugin for CSS injection in library mode; legitimate build tooling dependency.	ai	2026/04/27
phantom-deps	phantom-dep:typescript	AI (phantom-deps): TypeScript is a build-time dependency referenced in config files; normal for a TypeScript build tool package.	ai	2026/04/27
phantom-deps	phantom-dep:@types/gulp	AI (phantom-deps): Type definitions loaded by convention in TypeScript build tooling; not a direct import risk.	ai	2026/04/27
dependencies	unvetted-dep:@types/gulp	AI (dependencies): Standard TypeScript type definitions for gulp; expected dependency for a build tool package in the @nocobase ecosystem.	ai	2026/04/27
dependencies	unvetted-dep:@rsbuild/plugin-babel	AI (dependencies): Official Rsbuild Babel plugin from the ByteDance/web-infra-dev org; legitimate build tooling dependency.	ai	2026/04/27
dependencies	unvetted-dep:@types/lerna__package	AI (dependencies): Standard TypeScript type definitions for Lerna; expected for a monorepo build tool.	ai	2026/04/27
dependencies	unvetted-dep:@types/lerna__project	AI (dependencies): Standard TypeScript type definitions for Lerna; expected for a monorepo build tool.	ai	2026/04/27
bogus-package	bogus-package	AI (bogus-package): NocoBase is a large monorepo; scoped build packages typically lack standalone README/keywords and link to the main project docs. Not indicative of spam or phishing.	ai	2026/04/26
phantom-deps	phantom-dep:@rsbuild/plugin-babel	AI (phantom-deps): Build tool referencing rsbuild plugin in config is standard; stable for this package.	ai	2026/04/26
phantom-deps	phantom-dep:@types/lerna__package	AI (phantom-deps): Type-only package loaded by convention in a build tool; stable for this package.	ai	2026/04/26
phantom-deps	phantom-dep:react-imported-component	AI (phantom-deps): Referenced in config files for build tool; stable for this package.	ai	2026/04/26
phantom-deps	phantom-dep:vite-plugin-css-injected-by-js	AI (phantom-deps): Vite plugin referenced in config; standard for a build tool; stable for this package.	ai	2026/04/26
phantom-deps	phantom-dep:babel-plugin-syntax-dynamic-import	AI (phantom-deps): Babel plugin referenced in config; standard for a build tool; stable for this package.	ai	2026/04/26
phantom-deps	phantom-dep:@babel/plugin-syntax-dynamic-import	AI (phantom-deps): Babel plugin loaded by convention; standard for a build tool; stable for this package.	ai	2026/04/26
phantom-deps	phantom-dep:@babel/plugin-transform-modules-amd	AI (phantom-deps): Babel plugin loaded by convention; standard for a build tool; stable for this package.	ai	2026/04/26
phantom-deps	phantom-dep:postcss-preset-env	AI (phantom-deps): PostCSS plugin referenced in config; standard for a build tool; stable for this package.	ai	2026/04/26
phantom-deps	phantom-dep:@types/tar	AI (phantom-deps): Type-only package loaded by convention; stable for this package.	ai	2026/04/26
phantom-deps	phantom-dep:@types/lerna__project	AI (phantom-deps): Type-only package loaded by convention in a build tool; stable for this package.	ai	2026/04/26
phantom-deps	phantom-dep:less	AI (phantom-deps): Build tool referencing less in config files without direct import is standard; stable for this package.	ai	2026/04/26
phantom-deps	phantom-dep:postcss	AI (phantom-deps): Build tool referencing postcss in config files without direct import is standard; stable for this package.	ai	2026/04/26
phantom-deps	phantom-dep:css-loader	AI (phantom-deps): Build tool referencing css-loader in webpack/rspack config is standard; stable for this package.	ai	2026/04/26
phantom-deps	phantom-dep:babel-loader	AI (phantom-deps): Build tool referencing babel-loader in config is standard; stable for this package.	ai	2026/04/26
phantom-deps	phantom-dep:style-loader	AI (phantom-deps): Build tool referencing style-loader in config is standard; stable for this package.	ai	2026/04/26
phantom-deps	phantom-dep:@svgr/webpack	AI (phantom-deps): Build tool referencing @svgr/webpack in config is standard; stable for this package.	ai	2026/04/26
phantom-deps	phantom-dep:postcss-loader	AI (phantom-deps): Build tool referencing postcss-loader in config is standard; stable for this package.	ai	2026/04/26
phantom-deps	phantom-dep:@babel/core	AI (phantom-deps): Build tool loading @babel/core by convention is standard; stable for this package.	ai	2026/04/26
phantom-deps	phantom-dep:@babel/preset-env	AI (phantom-deps): Build tool loading @babel/preset-env by convention is standard; stable for this package.	ai	2026/04/26
semgrep	semgrep:env-spread	AI (semgrep): Build tool spreading process.env into child process spawn is standard practice for propagating environment context to compilation subprocesses. Not a credential leak risk.	ai	2026/04/25
typosquat	typosquat.levenshtein:esbuild	AI (typosquat): Scoped package @nocobase/build cannot be a typosquat of unscoped 'esbuild'; it is a build tool in the established NocoBase monorepo ecosystem.	ai	2026/04/25
typosquat	typosquat.levenshtein:uuid	AI (typosquat): Scoped package @nocobase/build cannot be a typosquat of unscoped 'uuid'; different namespace, different purpose entirely.	ai	2026/04/25
semgrep	semgrep:dynamic-require	AI (semgrep): Dynamic require is used to load package.json from the target package directory — standard pattern for build orchestration tools inspecting the package being built.	ai	2026/04/25