@oclif/plugin-test-esbuild

Bundled plugin for testing

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.

Maintainers

salesforce-releases

Keywords

oclif

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
source-diff	net-exec-file:dist/chunk-LPEKLRLJ.js	AI (source-diff): esbuild bundle of @oclif/core; __commonJS shims trigger heuristic but contain no actual network/exec payload.	ai	2026/05/21
source-diff	net-exec-file:dist/chunk-DQZ52UMY.js	AI (source-diff): Large esbuild bundle of @oclif/core deps; network+exec pattern is from bundled library code, not malware.	ai	2026/05/14
source-diff	net-exec-file:dist/chunk-EKTKY2AC.js	AI (source-diff): Large esbuild bundle of @oclif/core; network+exec pattern is from bundled oclif internals, not malware.	ai	2026/05/14
source-diff	net-exec-file:dist/chunk-HPGMPWKK.js	AI (source-diff): esbuild bundle of oclif/core deps; network+exec pattern is from bundled library code, not malware.	ai	2026/05/09
source-diff	net-exec-file:dist/chunk-6SHF5RLP.js	AI (source-diff): Large esbuild bundle of oclif/core deps; net+exec pattern is from bundled node_modules, not malicious code.	ai	2026/05/09
phantom-deps	phantom-dep:@oclif/core	AI (phantom-deps): Same-org test plugin; @oclif/core is a declared runtime dep used indirectly via bundled dist.	ai	2026/04/28
phantom-deps	phantom-dep:@oclif/plugin-test-esm-1	AI (phantom-deps): Same-org test plugin; referenced in oclif hooks config, not direct import.	ai	2026/04/28
phantom-deps	phantom-dep:@oclif/plugin-plugins	AI (phantom-deps): Same-org test plugin; dependency used indirectly in bundled output.	ai	2026/04/28