@openremote/util
Build Util
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| phantom-deps | phantom-dep:@types/eslint-scope | AI (phantom-deps): Types-only package; never directly imported, used for TS tooling by convention. | ai | |
| phantom-deps | phantom-dep:moment | AI (phantom-deps): Build/config-level dep for this util package; stable false positive. | ai | |
| phantom-deps | phantom-dep:@wc-toolkit/cem-inheritance | AI (phantom-deps): Config-scoped tooling dep; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:@wc-toolkit/storybook-helpers | AI (phantom-deps): Config-scoped tooling dep; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:@typescript-eslint/eslint-plugin | AI (phantom-deps): ESLint plugin loaded by config convention, not direct import. | ai | |
| phantom-deps | phantom-dep:@custom-elements-manifest/analyzer | AI (phantom-deps): CLI/config-scoped tooling dep; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:cross-env | AI (phantom-deps): Build tool dependency referenced in config files; stable false positive for this build utility package. | ai | |
| phantom-deps | phantom-dep:ts-loader | AI (phantom-deps): Build tool dependency referenced in config files; stable false positive for this build utility package. | ai | |
| phantom-deps | phantom-dep:css-loader | AI (phantom-deps): Build tool dependency referenced in config files; stable false positive for this build utility package. | ai | |
| phantom-deps | phantom-dep:typescript | AI (phantom-deps): Build tool dependency referenced in config files; stable false positive for this build utility package. | ai | |
| phantom-deps | phantom-dep:@rspack/cli | AI (phantom-deps): Build tool dependency referenced in config files; stable false positive for this build utility package. | ai | |
| phantom-deps | phantom-dep:@types/react | AI (phantom-deps): Type definition package; stable false positive for this build utility package. | ai | |
| phantom-deps | phantom-dep:source-map-loader | AI (phantom-deps): Build tool dependency referenced in config files; stable false positive for this build utility package. | ai | |
| typosquat | typosquat.levenshtein:uuid | AI (typosquat): Scoped package @openremote/util is a build utility; Levenshtein match to 'uuid' is a false positive. | ai | |
| phantom-deps | phantom-dep:eslint-plugin-import | AI (phantom-deps): Build tool dependency referenced in config files; stable false positive for this build utility package. | ai | |
| phantom-deps | phantom-dep:@wc-toolkit/jsx-types | AI (phantom-deps): Build tool dependency referenced in config files; stable false positive for this build utility package. | ai | |
| phantom-deps | phantom-dep:eslint-plugin-promise | AI (phantom-deps): Build tool dependency referenced in config files; stable false positive for this build utility package. | ai | |
| phantom-deps | phantom-dep:eslint-config-prettier | AI (phantom-deps): Build tool dependency referenced in config files; stable false positive for this build utility package. | ai | |
| phantom-deps | phantom-dep:eslint-config-standard | AI (phantom-deps): Build tool dependency referenced in config files; stable false positive for this build utility package. | ai | |
| phantom-deps | phantom-dep:@typescript-eslint/parser | AI (phantom-deps): Build tool dependency referenced in config files; stable false positive for this build utility package. | ai | |
| phantom-deps | phantom-dep:eslint-plugin-node | AI (phantom-deps): Build tool dependency referenced in config files; stable false positive for this build utility package. | ai | |
| semgrep | semgrep:child-process-import | AI (semgrep): Package is a CLI tool (bin: orutil); child_process use in cli.js is expected and legitimate. | ai | |
| phantom-deps | phantom-dep:shx | AI (phantom-deps): Build tool dependency referenced in config files; stable false positive for this build utility package. | ai | |
| phantom-deps | phantom-dep:eslint | AI (phantom-deps): Build tool dependency referenced in config files; stable false positive for this build utility package. | ai | |
| phantom-deps | phantom-dep:webpack | AI (phantom-deps): Build tool dependency referenced in config files; stable false positive for this build utility package. | ai | |
| phantom-deps | phantom-dep:prettier | AI (phantom-deps): Build tool dependency referenced in config files; stable false positive for this build utility package. | ai |
Versions (showing 51 of 58)
| Version | Deps | Published |
|---|---|---|
| 1.27.1 | 29 / 0 | |
| 1.27.0 | 29 / 0 | |
| 1.26.2 | 29 / 0 | |
| 1.26.1 | 29 / 0 | |
| 1.26.0 | 29 / 0 | |
| 1.25.0 | 28 / 0 | |
| 1.24.2 | 28 / 0 | |
| 1.24.1 | 27 / 0 | |
| 1.24.0 | 27 / 0 | |
| 1.23.1 | 27 / 0 | |
| 1.23.0 | 27 / 0 | |
| 1.22.1 | 27 / 0 | |
| 1.22.0 | 27 / 0 | |
| 1.21.0 | 27 / 0 | |
| 1.20.2 | 27 / 0 | |
| 1.20.1 | 27 / 0 | |
| 1.20.0 | 27 / 0 | |
| 1.19.0 | 27 / 0 | |
| 1.18.0 | 26 / 0 | |
| 1.17.3 | 26 / 0 | |
| 1.17.2 | 26 / 0 | |
| 1.17.1 | 26 / 0 | |
| 1.17.0 | 0 / 26 | |
| 1.16.1 | 0 / 26 | |
| 1.15.2 | 0 / 26 | |
| 1.15.1 | 0 / 26 | |
| 1.14.0 | 0 / 26 | |
| 1.13.1 | 0 / 25 | |
| 1.13.0 | 0 / 25 | |
| 1.12.3 | 0 / 25 | |
| 1.12.1 | 0 / 25 | |
| 1.12.0 | 0 / 25 | |
| 1.11.3 | 0 / 24 | |
| 1.11.2 | 0 / 24 | |
| 1.11.1 | 0 / 24 | |
| 1.11.0 | 0 / 24 | |
| 1.10.0 | 0 / 21 | |
| 1.9.0 | 0 / 21 | |
| 1.8.1 | 0 / 21 | |
| 1.8.0 | 0 / 21 | |
| 1.7.0 | 0 / 35 | |
| 1.6.5 | 0 / 35 | |
| 1.6.4 | 0 / 35 | |
| 1.6.3 | 0 / 35 | |
| 1.6.2 | 0 / 35 | |
| 1.6.0 | 0 / 35 | |
| 1.5.0 | 0 / 34 | |
| 1.4.0 | 0 / 34 | |
| 1.3.5 | 0 / 34 | |
| 1.3.4 | 0 / 34 | |
| 1.3.3 | 0 / 34 |
v1.27.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.27.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.26.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.26.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.26.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.5.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.4.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.3.5
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.3.4
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.3.3
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.