@ossy/app
Server-side rendering runtime and build tooling for Ossy apps.
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| dependencies | unvetted-dep:@ossy/manifest | AI (dependencies): Same-org sibling package, consistent naming/versioning with existing @ossy deps. | ai | |
| source-diff | source-size-dropped | AI (source-diff): No stub/malicious code evidence; likely build/packaging change. | ai | |
| publish-pattern | new-deps-added | AI (publish-pattern): Added dep is same-org sibling package (@ossy/platform), not third-party. | ai | |
| dependencies | unvetted-dep:@ossy/package-catalog | AI (dependencies): Same-org monorepo sibling dependency, consistent with existing @ossy/* deps. | ai | |
| dependencies | unvetted-dep:@ossy/resources | AI (dependencies): Same-org monorepo sibling dependency, consistent with existing @ossy/* deps. | ai | |
| dependencies | unvetted-dep:rollup-plugin-peer-deps-external | AI (dependencies): Widely-used rollup plugin; no malicious history; used only in build config, not at install time. | ai | |
| dependencies | unvetted-dep:@ossy/workspaces | AI (dependencies): Same-org package from the same trusted publisher; consistent with the @ossy monorepo pattern. | ai | |
| phantom-deps | phantom-dep:@rollup/plugin-inject | AI (phantom-deps): Rollup plugin loaded by convention; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:rollup-plugin-preserve-directives | AI (phantom-deps): Rollup config-file usage; stable false positive for this build-tool package. | ai | |
| phantom-deps | phantom-dep:rollup-plugin-peer-deps-external | AI (phantom-deps): Rollup config-file usage; stable false positive for this build-tool package. | ai | |
| phantom-deps | phantom-dep:rollup-plugin-node-externals | AI (phantom-deps): Rollup config-file usage; stable false positive for this build-tool package. | ai | |
| phantom-deps | phantom-dep:rollup-plugin-copy | AI (phantom-deps): Rollup config-file usage pattern; stable false positive for this build-tool package. | ai | |
| phantom-deps | phantom-dep:rollup-plugin-postcss-modules | AI (phantom-deps): Referenced in rollup config files; standard build-tool pattern. | ai | |
| phantom-deps | phantom-dep:@ossy/connected-components | AI (phantom-deps): Same-org scoped packages used as peer/framework deps; not directly imported by convention. | ai | |
| phantom-deps | phantom-dep:morgan | AI (phantom-deps): Framework/CLI tool loads deps by convention; stable false positive. | ai | |
| phantom-deps | phantom-dep:express | AI (phantom-deps): Framework/CLI tool loads deps by convention; stable false positive. | ai | |
| phantom-deps | phantom-dep:terser | AI (phantom-deps): Build tool dep loaded via config; stable false positive. | ai | |
| phantom-deps | phantom-dep:cookie-parser | AI (phantom-deps): Framework/CLI tool loads deps by convention; stable false positive. | ai | |
| phantom-deps | phantom-dep:@ossy/sdk | AI (phantom-deps): Same org scope; loaded by convention in the @ossy framework. | ai | |
| phantom-deps | phantom-dep:@ossy/router | AI (phantom-deps): Same org scope; loaded by convention in the @ossy framework. | ai | |
| phantom-deps | phantom-dep:@rollup/plugin-typescript | AI (phantom-deps): Framework-scoped; loaded by convention. | ai | |
| phantom-deps | phantom-dep:@ossy/sdk-react | AI (phantom-deps): Same-org package; declared for consumer use. | ai | |
| phantom-deps | phantom-dep:rollup-plugin-dts | AI (phantom-deps): Referenced in config files; standard for build framework packages. | ai | |
| phantom-deps | phantom-dep:@ossy/router-react | AI (phantom-deps): Same-org package; declared for consumer use. | ai | |
| phantom-deps | phantom-dep:rollup-plugin-delete | AI (phantom-deps): Referenced in config files; standard for build framework packages. | ai | |
| phantom-deps | phantom-dep:@babel/preset-react | AI (phantom-deps): Framework-scoped; loaded by convention. | ai | |
| phantom-deps | phantom-dep:@rollup/plugin-alias | AI (phantom-deps): Framework-scoped; loaded by convention. | ai | |
| phantom-deps | phantom-dep:@babel/eslint-parser | AI (phantom-deps): Framework-scoped; loaded by convention. | ai | |
| phantom-deps | phantom-dep:@ossy/design-system | AI (phantom-deps): Same-org package; declared for consumer use. | ai | |
| phantom-deps | phantom-dep:@babel/register | AI (phantom-deps): Framework-scoped; loaded by convention not direct import. | ai | |
| phantom-deps | phantom-dep:babel-loader | AI (phantom-deps): Referenced in config files; standard for build framework packages. | ai | |
| phantom-deps | phantom-dep:@ossy/themes | AI (phantom-deps): Same-org package bundled as runtime dep for consumers. | ai | |
| phantom-deps | phantom-dep:@ossy/pages | AI (phantom-deps): Same-org package bundled as runtime dep for consumers. | ai | |
| phantom-deps | phantom-dep:@babel/core | AI (phantom-deps): Build framework package; declared for downstream consumer use. | ai | |
| phantom-deps | phantom-dep:@babel/cli | AI (phantom-deps): Build framework package; plugins/presets declared for downstream consumer use. | ai | |
| typosquat | typosquat.levenshtein:pg | AI (typosquat): Scoped @ossy package with 148 versions; not a typosquat of pg. | ai | |
| typosquat | typosquat.levenshtein:hapi | AI (typosquat): Scoped @ossy package with 148 versions; not a typosquat of hapi. | ai | |
| semgrep | semgrep:env-spread | AI (semgrep): env-spread is in a dev CLI tool spawning a child process; standard pattern for dev servers passing environment through. | ai | |
| typosquat | typosquat.levenshtein:ajv | AI (typosquat): Scoped @ossy package with 148 versions; not a typosquat of ajv. | ai | |
| typosquat | typosquat.levenshtein:yup | AI (typosquat): Scoped @ossy package with 148 versions; not a typosquat of yup. | ai |
Versions (showing 100 of 218)
| Version | Deps | Published |
|---|---|---|
| 3.0.5 | 44 / 3 | |
| 3.0.4 | 44 / 3 | |
| 3.0.3 | 44 / 3 | |
| 3.0.2 | 44 / 3 | |
| 3.0.1 | 43 / 3 | |
| 1.40.3 | 40 / 3 | |
| 1.40.2 | 38 / 3 | |
| 1.40.1 | 38 / 3 | |
| 1.40.0 | 38 / 3 | |
| 1.39.7 | 37 / 3 | |
| 1.39.6 | 37 / 3 | |
| 1.39.5 | 37 / 3 | |
| 1.39.4 | 37 / 3 | |
| 1.39.3 | 37 / 3 | |
| 1.39.2 | 37 / 3 | |
| 1.39.1 | 37 / 3 | |
| 1.39.0 | 37 / 3 | |
| 1.38.0 | 37 / 3 | |
| 1.37.3 | 37 / 3 | |
| 1.37.2 | 37 / 3 | |
| 1.37.1 | 37 / 3 | |
| 1.37.0 | 37 / 3 | |
| 1.36.1 | 37 / 3 | |
| 1.36.0 | 37 / 3 | |
| 1.35.0 | 37 / 3 | |
| 1.34.0 | 37 / 3 | |
| 1.33.0 | 37 / 3 | |
| 1.32.3 | 37 / 3 | |
| 1.32.2 | 37 / 3 | |
| 1.32.1 | 37 / 3 | |
| 1.32.0 | 37 / 3 | |
| 1.31.0 | 37 / 3 | |
| 1.30.2 | 37 / 3 | |
| 1.30.1 | 38 / 3 | |
| 1.30.0 | 38 / 3 | |
| 1.29.0 | 38 / 3 | |
| 1.28.1 | 38 / 3 | |
| 1.28.0 | 38 / 3 | |
| 1.27.1 | 38 / 3 | |
| 1.27.0 | 38 / 3 | |
| 1.26.1 | 38 / 3 | |
| 1.26.0 | 38 / 3 | |
| 1.25.2 | 38 / 3 | |
| 1.25.1 | 38 / 3 | |
| 1.25.0 | 38 / 3 | |
| 1.24.1 | 38 / 3 | |
| 1.24.0 | 38 / 3 | |
| 1.23.6 | 38 / 3 | |
| 1.23.5 | 38 / 3 | |
| 1.23.4 | 38 / 3 | |
| 1.23.3 | 38 / 3 | |
| 1.23.2 | 38 / 3 | |
| 1.23.1 | 38 / 3 | |
| 1.23.0 | 38 / 3 | |
| 1.22.1 | 38 / 3 | |
| 1.22.0 | 38 / 3 | |
| 1.21.4 | 38 / 3 | |
| 1.21.3 | 38 / 3 | |
| 1.21.2 | 38 / 3 | |
| 1.21.1 | 38 / 3 | |
| 1.21.0 | 38 / 3 | |
| 1.20.1 | 38 / 3 | |
| 1.20.0 | 38 / 3 | |
| 1.19.0 | 38 / 3 | |
| 1.18.0 | 38 / 3 | |
| 1.17.12 | 38 / 3 | |
| 1.17.11 | 38 / 3 | |
| 1.17.10 | 38 / 3 | |
| 1.17.9 | 38 / 3 | |
| 1.17.8 | 38 / 3 | |
| 1.17.7 | 38 / 3 | |
| 1.17.6 | 38 / 3 | |
| 1.17.5 | 38 / 3 | |
| 1.17.4 | 38 / 3 | |
| 1.17.3 | 38 / 3 | |
| 1.16.11 | 38 / 3 | |
| 1.16.10 | 38 / 3 | |
| 1.16.9 | 38 / 3 | |
| 1.16.7 | 38 / 3 | |
| 1.16.6 | 38 / 3 | |
| 1.16.5 | 38 / 3 | |
| 1.16.4 | 38 / 3 | |
| 1.16.3 | 38 / 3 | |
| 1.16.2 | 38 / 3 | |
| 1.16.1 | 38 / 3 | |
| 1.16.0 | 38 / 3 | |
| 1.15.2 | 38 / 3 | |
| 1.15.1 | 38 / 3 | |
| 1.15.0 | 38 / 3 | |
| 1.14.0 | 38 / 3 | |
| 1.13.5 | 37 / 3 | |
| 1.13.4 | 37 / 3 | |
| 1.13.3 | 37 / 3 | |
| 1.13.2 | 37 / 3 | |
| 1.13.1 | 37 / 3 | |
| 1.13.0 | 37 / 3 | |
| 1.12.0 | 37 / 3 | |
| 1.11.9 | 37 / 3 | |
| 1.11.8 | 37 / 3 | |
| 1.11.7 | 37 / 3 |
v3.0.5
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.0.4
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.0.3
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.0.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.0.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.40.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.39.7
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.39.6
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.39.5
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.39.4
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.39.3
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.39.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.39.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.39.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.38.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.37.3
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.37.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.37.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.37.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.36.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.36.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.34.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.33.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.32.3
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.32.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.32.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.32.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.31.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.30.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.30.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.30.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.29.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.28.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.28.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.27.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.26.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.25.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.25.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.25.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.24.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.24.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.23.6
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.23.5
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.23.4
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.23.3
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.23.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.23.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.23.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.22.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.22.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.21.4
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.21.3
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.20.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.17.11
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.17.10
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.17.9
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.17.7
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.17.6
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.17.5
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.17.4
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.17.3
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.16.9
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.16.7
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.16.6
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.16.4
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.16.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.16.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.15.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.15.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.14.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.13.5
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.13.3
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.13.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.13.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.13.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.12.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.11.9
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.11.8
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.