← Home

@nx/powerpack-owners

npm Homepage

A Nx Powerpack plugin which provides the ability to configure and maintain codeowners for projects in Nx workspaces.

8
Versions
Commercial
License
No
Install Scripts
Missing
Provenance

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures No source commit

Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.

Maintainers

nrwlownernrwl-jasonjack-nrwlmaxklessjameshenry

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
provenance missing-githead AI (provenance): Nx publishes via GitHub Actions CI; missing gitHead is a metadata gap, not a security risk for this established package. ai
semgrep semgrep:obfuscation-while-true AI (semgrep): Nx Powerpack commercial plugins intentionally ship obfuscated bundles to protect proprietary code; stable pattern for this package. ai
semgrep semgrep:dynamic-require AI (semgrep): Dynamic require is an artifact of the obfuscated bundle output, not independent malware signal for this package. ai

Versions (showing 8 of 8)

Version Deps Published
5.0.7 1 / 0
5.0.6 1 / 0
5.0.5 1 / 0
5.0.4 1 / 0
5.0.3 1 / 0
5.0.2 1 / 0
5.0.1 1 / 0
5.0.0 1 / 0

v5.0.7

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v5.0.6

2 findings
HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: GitHub Actions.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v5.0.5

2 findings
HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: GitHub Actions.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v5.0.4

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v5.0.3

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v5.0.2

2 findings
HIGH obfuscation-while-true: src/index.js:1 semgrep

while(!![]) loop is a signature of javascript-obfuscator output > 1 | 'use strict';var a0_0x258a6e=a0_0x1d63;(function(_0x523d4,_0x1f0a87){var _0x50b906=a0_0x1d63,_0x208753=_0x523d4();while(

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v5.0.1

2 findings
HIGH obfuscation-while-true: src/index.js:1 semgrep

while(!![]) loop is a signature of javascript-obfuscator output > 1 | 'use strict';var a0_0x12bb7e=a0_0x321c;(function(_0x285980,_0x5219ee){var _0x593d1c=a0_0x321c,_0x2dbb55=_0x285980();whil

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v5.0.0

2 findings
HIGH obfuscation-while-true: src/index.js:1 semgrep

while(!![]) loop is a signature of javascript-obfuscator output > 1 | 'use strict';function a0_0x1a0b(_0x36be09,_0x5d9c0d){var _0x480394=a0_0x4803();return a0_0x1a0b=function(_0x1a0b32,_0x30

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.