← Home

@open-mercato/shared

npm Repository Homepage

The shared foundation for Open Mercato packages.

14
Versions
—
License
No
Install Scripts
Verified
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures No source commit

Maintainers

pat-lewczukpatryk.andrzejewskipiotrkarwatka

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
phantom-deps phantom-dep:pino AI (phantom-deps): Logger referenced via config/bootstrap, not direct import; expected pattern. ai
phantom-deps phantom-dep:@types/sanitize-html AI (phantom-deps): Type-only package loaded by convention, not directly imported. ai
bogus-package bogus-package AI (bogus-package): Internal shared library for @open-mercato org; no public repo/homepage is expected for this pattern. ai
semgrep semgrep:etc-passwd-access AI (semgrep): Appears only in test asserting /etc/passwd URLs are rejected by the URL safety validator — not credential harvesting. ai
semgrep semgrep:base64-decode AI (semgrep): Base64 decode is standard JWT payload parsing, not obfuscation or payload hiding. ai
semgrep semgrep:env-spread AI (semgrep): process.env spread is in a test fixture to save/restore env state, not to exfiltrate secrets. ai
semgrep semgrep:shady-links-raw-ip AI (semgrep): Raw IPs appear only in test cases asserting private IP URLs are rejected — expected pattern for a URL safety library. ai

Versions (showing 14 of 14)

Version Deps Published
0.6.6 12 / 4
0.6.5 10 / 4
0.6.4 10 / 4
0.6.3 10 / 4
0.6.2 10 / 4
0.6.1 9 / 4
0.6.0 9 / 4
0.5.0 2 / 4
0.4.10 1 / 3
0.4.9 1 / 3
0.4.8 1 / 3
0.4.7 1 / 3
0.4.6 1 / 3
0.4.5 1 / 3

v0.6.6

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.6.1

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.