@pellux/goodvibes-sdk
47
Versions
—
License
No
Install Scripts
Verified
Provenance
Supply chain provenance
Status for the latest visible version.
SLSA provenance attestation
npm registry signatures
gitHead linked
Maintainers
mgd34msu
Keywords
goodvibessdkbrowserreact-nativecontrol-plane
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| phantom-deps | phantom-dep:@pellux/goodvibes-toolchain | AI (phantom-deps): Same-org monorepo package, expected declared-but-indirectly-used dep. | ai | |
| dependencies | unvetted-dep:@pellux/goodvibes-contracts | AI (dependencies): First-party sibling pinned to same version. | ai | |
| dependencies | unvetted-dep:@pellux/goodvibes-daemon-sdk | AI (dependencies): First-party sibling pinned to same version. | ai | |
| dependencies | unvetted-dep:@pellux/goodvibes-operator-sdk | AI (dependencies): First-party sibling pinned to same version. | ai | |
| dependencies | unvetted-dep:@pellux/goodvibes-transport-core | AI (dependencies): First-party sibling pinned to same version. | ai | |
| dependencies | unvetted-dep:@pellux/goodvibes-transport-http | AI (dependencies): First-party sibling pinned to same version. | ai | |
| dependencies | unvetted-dep:@pellux/goodvibes-transport-direct | AI (dependencies): First-party sibling pinned to same version. | ai | |
| dependencies | unvetted-dep:@pellux/goodvibes-transport-realtime | AI (dependencies): First-party sibling pinned to same version. | ai | |
| dependencies | unvetted-dep:@pellux/goodvibes-errors | AI (dependencies): First-party sibling pinned to same version; internal to the umbrella SDK. | ai | |
| dependencies | unvetted-dep:@pellux/goodvibes-peer-sdk | AI (dependencies): First-party sibling pinned to same version. | ai | |
| phantom-deps | phantom-dep:bash-language-server | AI (phantom-deps): LSP binary invoked via config, not imported. | ai | |
| phantom-deps | phantom-dep:typescript-language-server | AI (phantom-deps): LSP binary invoked via config, not imported. | ai | |
| phantom-deps | phantom-dep:@aws/bedrock-token-generator | AI (phantom-deps): Auxiliary AWS SDK helper referenced via config. | ai | |
| phantom-deps | phantom-dep:vscode-langservers-extracted | AI (phantom-deps): LSP tooling bundle invoked via config, not imported. | ai | |
| phantom-deps | phantom-dep:pyright | AI (phantom-deps): LSP/tooling dep referenced via config, not direct import. | ai | |
| phantom-deps | phantom-dep:@anthropic-ai/sdk | AI (phantom-deps): Well-known SDK, used indirectly. | ai |
Versions (showing 47 of 47)
| Version | Deps | Published |
|---|---|---|
| 0.33.24 | 8 / 0 | |
| 0.33.17 | 8 / 0 | |
| 0.21.0 | 25 / 0 | |
| 0.19.9 | 25 / 0 | |
| 0.19.8 | 25 / 0 | |
| 0.19.6 | 25 / 0 | |
| 0.18.53 | 25 / 0 | |
| 0.18.52 | 25 / 0 | |
| 0.18.51 | 25 / 0 | |
| 0.18.50 | 25 / 0 | |
| 0.18.49 | 25 / 0 | |
| 0.18.48 | 25 / 0 | |
| 0.18.47 | 25 / 0 | |
| 0.18.46 | 25 / 0 | |
| 0.18.43 | 25 / 0 | |
| 0.18.42 | 25 / 0 | |
| 0.18.41 | 25 / 0 | |
| 0.18.40 | 25 / 0 | |
| 0.18.38 | 25 / 0 | |
| 0.18.37 | 25 / 0 | |
| 0.18.36 | 25 / 0 | |
| 0.18.35 | 25 / 0 | |
| 0.18.34 | 25 / 0 | |
| 0.18.33 | 25 / 0 | |
| 0.18.32 | 25 / 0 | |
| 0.18.31 | 25 / 0 | |
| 0.18.30 | 25 / 0 | |
| 0.18.29 | 25 / 0 | |
| 0.18.28 | 25 / 0 | |
| 0.18.27 | 25 / 0 | |
| 0.18.26 | 25 / 0 | |
| 0.18.25 | 25 / 0 | |
| 0.18.24 | 25 / 0 | |
| 0.18.23 | 25 / 0 | |
| 0.18.22 | 25 / 0 | |
| 0.18.21 | 25 / 0 | |
| 0.18.20 | 25 / 0 | |
| 0.18.19 | 25 / 0 | |
| 0.18.18 | 25 / 0 | |
| 0.18.17 | 25 / 0 | |
| 0.18.16 | 25 / 0 | |
| 0.18.15 | 25 / 0 | |
| 0.18.14 | 25 / 0 | |
| 0.18.13 | 25 / 0 | |
| 0.18.12 | 25 / 0 | |
| 0.18.11 | 25 / 0 | |
| 0.18.3 | 9 / 0 |
v0.18.28
1 finding
INFO
Has SLSA provenance attestation
provenance
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.